Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome's insane password security strategy

blog.elliottkember.com

Post reply on HN
Print view View original

111–120 of 315 posts

Re: Chrome's insane password security strategy

#111

Post by aa0 »

throwaway2048 wrote: post #47
aa0 wrote: post #19

Given that the input password type auto filled by browsers offers no security, I propose a new standard input type called passwordhash. The actual password would have to be backed in RAM if the field is set to editable. But if it isn't, upon editing it would clear the current input. Having hashes stored instead of actual passwords is of course not a total solution because someone savvy enough could use those same has…

in this scheme the hash effectively becomes your password, how is this helping anything ?

Did you read my whole post? With the salt attribute, a level based system can be implemented -- effectively a different hash would be required for more critical user-actions. That is, you'd need to re-type your password in the website to perform certain actions - but it would be the same password - just a different salt.

Re: Chrome's insane password security strategy

#112

Post by Spoike »

elliottkember wrote: post #81
justinschuh wrote: post #79

Earlier quoted context omitted.

Soft boundaries within the user account do nothing to protect you from exactly those scenarios either. Your protection is to lock your OS user account.

Hey Justin, I'm the author. I appreciate your sentiments, but I feel like they may be out of touch with the way real people are using computers in the wild. My suggestion is to seriously re-evaluate this approach in light of the actual use-case of how people perceive these passwords. It appears as though many, many users don't expect these passwords to be visible. This is an important thing to take into consideration…

Technically passwords that should be retrieved at a later date are stored using two-way encryption. So the thing is, the passwords are always "visible", as they're retrievable. Removing the "Show" button is not really making things more secure as it is retrievable using other means. This is same with all browsers that save passwords.

You could lock it away with a one-way encrypted password but the problem with that is it's just "theatrics", giving a false sense of security... the stored passwords are still two-way encrypted either way, or else they can't be retrieved for later use. That means it is just as breakable as if they weren't. Once the hacker finds the password database on your computer it should be considered compromised.

If you don't trust your browser or your computer then you should use a service like LastPass or 1Password, i.e. if you consider them trustworthy to handle your passwords and if you're not on an insecure WIFI network. There is really no other way around it.

I do agree though that all browsers should be more clear about it... unfortunately it's not particularly easy to explain computer security to a user who is not a computer science nerd.

Re: Chrome's insane password security strategy

#113

Post by PersonFace »

justinschuh wrote: post #77

I'm the Chrome browser security tech lead, so it might help if I explain our reasoning here. The only strong permission boundary for your password storage is the OS user account. So, Chrome uses whatever encrypted storage the system provides to keep your passwords safe for a locked account. Beyond that, however, we've found that boundaries within the OS user account just aren't reliable, and are mostly just theater.…

If the attacker is at the keyboard of your logged-in, not-screen-locked computer, you have definitely already lost. Regardless of the skill level of the attacker.

If this attacker is your friend, co-worker, spouse, room-mate or the like, your problem is social and not technical.

Those two points really should be obvious to everyone here. (This is a forum for software engineers, right?)

It is safer (and more honest) to provide no security mechanism where none can work, than to provide a fake mechanism and then claim that it can work. Perhaps people are so mentally abused by decades of security snake-oil (e.g. anti-virus products) that they have come to accept snake-oil as the pinnacle of security engineering. I don't know how else to explain what is going on in this thread...

Re: Chrome's insane password security strategy

#114

Post by therealbobdole »

elliottkember wrote: post #81
justinschuh wrote: post #79

Earlier quoted context omitted.

Soft boundaries within the user account do nothing to protect you from exactly those scenarios either. Your protection is to lock your OS user account.

Hey Justin, I'm the author. I appreciate your sentiments, but I feel like they may be out of touch with the way real people are using computers in the wild. My suggestion is to seriously re-evaluate this approach in light of the actual use-case of how people perceive these passwords. It appears as though many, many users don't expect these passwords to be visible. This is an important thing to take into consideration…

I won't be using Chrome again until this behavior can be turned off.

Re: Chrome's insane password security strategy

#115

Post by brown9-2 »

Throwadev wrote: post #92
elliottkember wrote: post #87

Earlier quoted context omitted.

You're right, locking the operating system will secure it. But people aren't doing that. And people lend their computers to friends sometimes. It happens. I think the actual situation is that you don't understand how people are using computers, and how people expect them to behave - which is very important. Your software allows me to open up one application and see all passwords. It's likely the single most-used appl…

Elliottkmember is right here. Chrome's approach to this is absurd. What if you simply don't want friends, coworkers, significant others browsing your passwords? At least tell users that if they choose to save passwords in Chrome, that everyone who uses their computer, even pretty non-technical people, will be able to access those passwords. Tell them that storing their passwords in Chrome is unsafe. Justin, can you t…

Please don't invent motivations for the statements people make when you don't like what they've stated so far.

If you don't want people browsing your passwords, you can't ever give them access to your user account or your unlocked desktop. That's it, that is the entire solution. Any other method of protecting the passwords is vulnerable as long as the potential attacker has physical access to the unlocked desktop.

Now, perhaps some of this is mitigated by the fact that most of those friends, coworkers, significant others won't know how to install a keylogger or install extensions - but some small percentage will anyway, and those users who were lulled into a false sense of security will have been just as exploited anyway.

Re: Chrome's insane password security strategy

#116

Post by jmotion »

This has got to be a case of them being completely out of touch with the average user.

I've been using web browsers for over 10 years and assumed a browser wouldn't make it this easy to find passwords.

After reading this I quickly checked and saw over 50 accounts listed all with the passwords in plain text next to them.

I guarantee each and every one of my friends that don't work in IT don't know about this - I could ask them all if I could quickly borrow there laptop to check a soccer score and find out the majority of there passwords.

What needs to be done is make people more aware of what's happening when they save a password - and perhaps a quick pop up in the bottom right coming up notifying them which passwords are saved and if they want to clear them before lending out, or leaving it unattended.

Re: Chrome's insane password security strategy

#117

Post by herf »

justinschuh wrote: post #79
madaxe wrote: post #78

Earlier quoted context omitted.

But it is a false sense of security. Joe User doesn't know a thing about how this magical box of tricks called a computer works. He just assumes that his data is safe on it, and won't get into the wrong hands, and that his passwords will always be protected by asterisks or what-not. Sure, you may encrypt them using keychain, which is good, and yes, if someone has physical access to their machine and user account then…

Soft boundaries within the user account do nothing to protect you from exactly those scenarios either. Your protection is to lock your OS user account.

Threat model is simple: people look at your passwords and type them in somewhere else.

What's technically possible for serious malware, or what someone can do with unlimited access to your computer for hours is not the point.

Reality is time-constrained, and UIs that slow people down are useful in this case.

Re: Chrome's insane password security strategy

#118

Post by mstroeck »

justinschuh wrote: post #86
elliottkember wrote: post #84

Earlier quoted context omitted.

Novice? I'm sorry, but whether I'm a novice has absolutely nothing to do with this. What I'm proposing is that you just don't show our passwords, all in one window, in plain text. I agree that this won't solve the problem, but would be a good first step. And I don't see how that would be dangerous. Alternatively, Chrome should make this more obvious so that users don't make assumptions about its security. How on eart…

It matters that you don't seem to understand the threat model here. You think your passwords are protected somehow in other applications, but they're simply not. The fact is that they're still trivially recoverable, and if the bad guy can read them at all than he already has access to fully compromise your entire OS user account. So, you're arguing that we take measures to make users think they're safe when they've a…

You might have noticed (from her screenshots) that she is using Mac OS X.

Simply gaining physical access to the machine should ABSOLUTELY NOT enable an attacker to extract practically all web passwords in something like 15 seconds, without any special tools.

Are you completely ignorant of how the OS X Keychain works and should be implemented application-side, or are you just willfully ignoring it?

Re: Chrome's insane password security strategy

#119

Post by elliottkember »

jerrya wrote: post #110
elliottkember wrote: post #94

Earlier quoted context omitted.

You're right, and this is really bad. The thing Chrome gives you on top of this is greater discoverability - i.e. a list of ALL passwords - and a few buttons to make it easier for non-technical users.

"Today, go up to somebody non-technical. Ask to borrow their computer. Visit chrome://settings/passwords and click “show” on a few of the rows. See what they have to say." Someone that does that to me would not get a punch in the nose, but that is certainly what they would deserve.

I suppose it's a pretty in-your-face way of showing you. But it would certainly get the message across. It'd be a bit of a shock, right?

Re: Chrome's insane password security strategy

#120

Post by sequoia »

elliottkember wrote: post #81
justinschuh wrote: post #79

Earlier quoted context omitted.

Soft boundaries within the user account do nothing to protect you from exactly those scenarios either. Your protection is to lock your OS user account.

Hey Justin, I'm the author. I appreciate your sentiments, but I feel like they may be out of touch with the way real people are using computers in the wild. My suggestion is to seriously re-evaluate this approach in light of the actual use-case of how people perceive these passwords. It appears as though many, many users don't expect these passwords to be visible. This is an important thing to take into consideration…

fwiw Pidgin takes this same approach for the same reasons. https://developer.pidgin.im/wiki/PlainTextPasswords

"locking" the passwords would require intermittent master-pass entry like `sudo`, this would come off as an inconvenience to many users.

I think people here miss the fact that many users, even if they say they want more security, are unwilling to give up convenience and will switch platforms (i.e. browsers) if that's what it takes to get a smoother experience. In many ways (in this particular instance) security vs. convenience is more or less 0 sum- chrome team has decided users would prefer more convenience which means less security. Chrome team is giving users what they want: ease of use.

Post reply on HN