Chrome's insane password security strategy • Hacker News Board

Re: Chrome's insane password security strategy

#101

Post by peth19 » Tue, Aug 06, 2013, 5:06 PM UTC

justinschuh wrote: post #86

elliottkember wrote: post #84

Earlier quoted context omitted.

Novice? I'm sorry, but whether I'm a novice has absolutely nothing to do with this. What I'm proposing is that you just don't show our passwords, all in one window, in plain text. I agree that this won't solve the problem, but would be a good first step. And I don't see how that would be dangerous. Alternatively, Chrome should make this more obvious so that users don't make assumptions about its security. How on eart…

It matters that you don't seem to understand the threat model here. You think your passwords are protected somehow in other applications, but they're simply not. The fact is that they're still trivially recoverable, and if the bad guy can read them at all than he already has access to fully compromise your entire OS user account. So, you're arguing that we take measures to make users think they're safe when they've a…

How does palming the problem off onto the OS help? At least the OS provides the choice to lock/leave open.

Smacks of laziness, especially in a world where it often takes very little to deter people.

Re: Chrome's insane password security strategy

#102

Post by jmcentire » Tue, Aug 06, 2013, 5:11 PM UTC

justinschuh wrote: post #86

elliottkember wrote: post #84

Earlier quoted context omitted.

Novice? I'm sorry, but whether I'm a novice has absolutely nothing to do with this. What I'm proposing is that you just don't show our passwords, all in one window, in plain text. I agree that this won't solve the problem, but would be a good first step. And I don't see how that would be dangerous. Alternatively, Chrome should make this more obvious so that users don't make assumptions about its security. How on eart…

It matters that you don't seem to understand the threat model here. You think your passwords are protected somehow in other applications, but they're simply not. The fact is that they're still trivially recoverable, and if the bad guy can read them at all than he already has access to fully compromise your entire OS user account. So, you're arguing that we take measures to make users think they're safe when they've a…

Forgive me for not looking at Chrome's source code on this, but I'm going to go ahead and assume that Chrome doesn't encrypt the passwords on the disk. You can easily do better than this while maintaining all of your current functionality.

On my system, I have installed scrypt and use it as a password management tool. When I need a password, I simply run a shell script I created, type my master password, and the password I'm searching for is placed in my clipboard.

Sure, I could write an extension to do this and I really should be concerned with the security of the clipboard implementation... but, those are fairly trivial (I do flush my clipboard buffer when I'm done).

This would be a simple solution for Chrome, actually. You already have all of the works for managing passwords implemented. All you need to do is add in the decryption process and simply not log the master password.

In this way, even the root user wouldn't have access to a user's passwords (as is currently the case with Chrome).

Re: Chrome's insane password security strategy

#103

Post by randomstep » Tue, Aug 06, 2013, 5:19 PM UTC

justinschuh wrote: post #83

elliottkember wrote: post #81

Earlier quoted context omitted.

Hey Justin, I'm the author. I appreciate your sentiments, but I feel like they may be out of touch with the way real people are using computers in the wild. My suggestion is to seriously re-evaluate this approach in light of the actual use-case of how people perceive these passwords. It appears as though many, many users don't expect these passwords to be visible. This is an important thing to take into consideration…

I appreciate how this appears to a novice, but we've literally spent years evaluating it and have quite a bit of data to inform our position. And while you're certainly well intentioned, what you're proposing is that that we make users less safe than they are today by providing them a false sense of security and encouraging dangerous behavior. That's just not how we approach security on Chrome.

So why store passwords then? Doesn't that also lull users into a false sense of security?

It seems to me you won't make token efforts to protect a user's password because that protection would be an illusion. So you would rather tell them the truth, so to speak, by letting them discover that their passwords are all easily visible by anyone who sits down at their machine. But if that's really the best you can do (I'm accepting this claim for the sake of argument), why store the passwords at all? Just by offering to store the passwords you are lying to the user, and lulling them into dangerous behavior.

Do you have data that users expect the passwords to be shown, or that storing them and making them so easy to see has any positive effect on users' password hygiene or security behavior? As for me, I know never to ever allow Chrome to store any password. Has that made me more secure? And is that representative at all of the standard user? I highly doubt it, but don't have any evidence either way.

Re: Chrome's insane password security strategy

#104

Post by avidpreatorain » Tue, Aug 06, 2013, 5:28 PM UTC

justinschuh wrote: post #86

elliottkember wrote: post #84

Earlier quoted context omitted.

Novice? I'm sorry, but whether I'm a novice has absolutely nothing to do with this. What I'm proposing is that you just don't show our passwords, all in one window, in plain text. I agree that this won't solve the problem, but would be a good first step. And I don't see how that would be dangerous. Alternatively, Chrome should make this more obvious so that users don't make assumptions about its security. How on eart…

It matters that you don't seem to understand the threat model here. You think your passwords are protected somehow in other applications, but they're simply not. The fact is that they're still trivially recoverable, and if the bad guy can read them at all than he already has access to fully compromise your entire OS user account. So, you're arguing that we take measures to make users think they're safe when they've a…

There is a simple fix for this and FireFox uses it. Simply, allow users to create a master password to view stored passwords. They don't need to be asked to enter it every time they log into sites so the ease of use remains. But, if a stranger gets a hold of their machine, they will be one giant step farther from retrieving their passcodes.

PS. This was always an issue with Chrome, and it is why I don't use Chrome on my mobile machine. Safari has a similar problem. So I recommend 1Password for mobile computing if those are your browsers of choice.

Re: Chrome's insane password security strategy

#105

Post by marcgg » Tue, Aug 06, 2013, 5:31 PM UTC

justinschuh wrote: post #77

I'm the Chrome browser security tech lead, so it might help if I explain our reasoning here. The only strong permission boundary for your password storage is the OS user account. So, Chrome uses whatever encrypted storage the system provides to keep your passwords safe for a locked account. Beyond that, however, we've found that boundaries within the OS user account just aren't reliable, and are mostly just theater.…

I understand that a master password would just lead the user into a false sense of security. However, I feel that it should be make as hard as possible to find the user's password.

A good safe is judged by the time required to break it. There is no safe that is unbreakable, you just need to put enough time, effort and noise to open it. Same thing could be applied here. Installing software, dump the cookies and so on requires time. Right now with this security a person could get my password in a couple of clicks with almost no technical knowledge. I'm not talking about a clever hacker, but rather a random person in a cafe with wifi asking someone if she could check her emails and steal the password while staying in Chrome. Again, it's not about making it impossible to retrieve, it's about making it a bit harder than just clicking the "show me the password" button.

Of course I would never give physical access to my machine to anyone I don't trust. I always lock my computer when leaving it unattended... but I really doubt that anyone acts like that. It's a pretty geeky thing to do and the mainstream crowd isn't as worried by security.

Let's say the master password solution isn't good because of the feeling of security it brings. Instead why not never show the password? Just say to the users it's stored on your system, but don't show it in plain text in Chrome.

My point here is that there is little to no value (unless I'm missing something) to display the password in plain text, but there are some drawbacks (easy to see for semi-technical people). So why have this feature in the first place?

Re: Chrome's insane password security strategy

#106

Post by Elusive » Tue, Aug 06, 2013, 5:51 PM UTC

jmcentire wrote: post #102

justinschuh wrote: post #86

Earlier quoted context omitted.

It matters that you don't seem to understand the threat model here. You think your passwords are protected somehow in other applications, but they're simply not. The fact is that they're still trivially recoverable, and if the bad guy can read them at all than he already has access to fully compromise your entire OS user account. So, you're arguing that we take measures to make users think they're safe when they've a…

Forgive me for not looking at Chrome's source code on this, but I'm going to go ahead and assume that Chrome doesn't encrypt the passwords on the disk. You can easily do better than this while maintaining all of your current functionality. On my system, I have installed scrypt and use it as a password management tool. When I need a password, I simply run a shell script I created, type my master password, and the pass…

Apparently, Chrome does encrypt passwords, using the Windows cryptography APIs: http://raidersec.blogspot.in/2013/06/how-browsers-store-your...

It's not secure against any attacks running under the user, though.

Re: Chrome's insane password security strategy

#107

Post by brentsota » Tue, Aug 06, 2013, 6:07 PM UTC

justinschuh wrote: post #86

elliottkember wrote: post #84

Earlier quoted context omitted.

Novice? I'm sorry, but whether I'm a novice has absolutely nothing to do with this. What I'm proposing is that you just don't show our passwords, all in one window, in plain text. I agree that this won't solve the problem, but would be a good first step. And I don't see how that would be dangerous. Alternatively, Chrome should make this more obvious so that users don't make assumptions about its security. How on eart…

It matters that you don't seem to understand the threat model here. You think your passwords are protected somehow in other applications, but they're simply not. The fact is that they're still trivially recoverable, and if the bad guy can read them at all than he already has access to fully compromise your entire OS user account. So, you're arguing that we take measures to make users think they're safe when they've a…

A solid argument if the average Chrome user is a regular HN reader.

Re: Chrome's insane password security strategy

#108

Post by cyansmoker » Tue, Aug 06, 2013, 6:07 PM UTC

justinschuh wrote: post #86

elliottkember wrote: post #84

Earlier quoted context omitted.

Novice? I'm sorry, but whether I'm a novice has absolutely nothing to do with this. What I'm proposing is that you just don't show our passwords, all in one window, in plain text. I agree that this won't solve the problem, but would be a good first step. And I don't see how that would be dangerous. Alternatively, Chrome should make this more obvious so that users don't make assumptions about its security. How on eart…

It matters that you don't seem to understand the threat model here. You think your passwords are protected somehow in other applications, but they're simply not. The fact is that they're still trivially recoverable, and if the bad guy can read them at all than he already has access to fully compromise your entire OS user account. So, you're arguing that we take measures to make users think they're safe when they've a…

I am a tad shocked by your reply, and this for several reasons. Let's not even talk about how you inferred Eliott's credentials, or lack thereof, based on his disagreeing with your approach.

You write about "lulling your users into a false sense of security." If that is true, then how do you explain that the 'show' button only appears when clicking a password? In the name of full disclosure, shouldn't you make that option immediately visible?

Furthermore, contrary to what was posted here, I believe that you encrypt passwords when storing them. On Windows, you would use the user's password as a "master password" in fact. So, kudos for that. But, wait, isn't this a case of using a master password to lull the user... etc? (because, you know, things such as Ophcrak do not exist?)

I am not going to re-iterate what was already written about the cable guy being able to lift your password in 10 seconds, it's simply a scenario you cannot dismiss and it seems strange to me as I would expect you guys to do some persona-based design rather than deal in hypotheticals (cf. "trivially recoverable")

So, yes, Chrome is an excellent product. And yes, from an absolute standpoint, you make valid points. I simply do not believe that you are the only one here doing so, and if you are willing to post comment on HN, then hopefully you are also ready to acknowledge that things are not as clearcut as you make them to be.

Re: Chrome's insane password security strategy

#109

Post by neilk » Tue, Aug 06, 2013, 6:21 PM UTC

elliottkember wrote: post #81

justinschuh wrote: post #79

Earlier quoted context omitted.

Soft boundaries within the user account do nothing to protect you from exactly those scenarios either. Your protection is to lock your OS user account.

Hey Justin, I'm the author. I appreciate your sentiments, but I feel like they may be out of touch with the way real people are using computers in the wild. My suggestion is to seriously re-evaluate this approach in light of the actual use-case of how people perceive these passwords. It appears as though many, many users don't expect these passwords to be visible. This is an important thing to take into consideration…

If I have access to your browser, I can get your credentials for Amazon by just going to Amazon.com. Either you already have a session open, and then I can do what I want (including changing your password), or the browser (or your password manager) is going to fill in the password automatically, and with a trivial knowledge of how the browser works I can copy the password.

I use LastPass, and it is possible to set it so that a master password is required before any password is automatically entered, but in practice no ordinary user can suffer the loss of usability there.

Passwords are not actually the thing we are trying to protect. We're trying to protect against a user being able to use your credentials. If they have access to your browser, they have that already.

Maybe requiring you to re-enter your login session password, as a pseudo master password, would slow down a really naive attacker. But it will probably also annoy people who just need to get their passwords for some other reason. I would like to hear more from the Chrome team here on their reasoning but I would not be surprised if a 'master' password just leads to more users storing passwords on post-it notes.

Re: Chrome's insane password security strategy

#110

Post by jerrya » Tue, Aug 06, 2013, 6:31 PM UTC

elliottkember wrote: post #94

Schlaefer wrote: post #57

Earlier quoted context omitted.

Note that Chrome is using keychain and that you can dump the complete keychain data with all passwords decrypted via terminal anyway. You don't need any third party software ala Chrome installed. E.g.: security find-internet-password -g -s news.ycombinator.com Klick allow and that's it. The master password question for showing individual passwords in the Keychain.app does not protect your passwords. As others said: d…

You're right, and this is really bad. The thing Chrome gives you on top of this is greater discoverability - i.e. a list of ALL passwords - and a few buttons to make it easier for non-technical users.

"Today, go up to somebody non-technical. Ask to borrow their computer. Visit chrome://settings/passwords and click “show” on a few of the rows. See what they have to say."

Someone that does that to me would not get a punch in the nose, but that is certainly what they would deserve.