Chrome's insane password security strategy • Hacker News Board

Re: Chrome's insane password security strategy

#171

Post by interpol_p » Wed, Aug 07, 2013, 12:28 PM UTC

mkautzm wrote: post #147

justinschuh wrote: post #77

I'm the Chrome browser security tech lead, so it might help if I explain our reasoning here. The only strong permission boundary for your password storage is the OS user account. So, Chrome uses whatever encrypted storage the system provides to keep your passwords safe for a locked account. Beyond that, however, we've found that boundaries within the OS user account just aren't reliable, and are mostly just theater.…

I'm inclined to agree with Justin here. I mean, he's absolutely right in that if you have physical access, or if you have OS account access to a computer, it really doesn't matter what you do, your shit isn't safe any more. The argument of a 'crime of opportunity' doesn't play out in the digital world. Everything in the malware world is so automated and the scenario of 'If there are exposed passwords on this particul…

That's not realistic. Do you work with your personal laptop in a work environment? I do. Sometimes you're debugging on a co-worker's machine and they step out of the room to get some water.

This flaw makes it possible to read their web passwords in a manner which is not suspicious, quick, and not easy to trace.

If it even took slightly longer, or there was a risk of being caught attached to this action it would be far less likely for someone to casually browse another's passwords.

Re: Chrome's insane password security strategy

#172

Post by interpol_p » Wed, Aug 07, 2013, 12:32 PM UTC

garethadams wrote: post #39

weiran wrote: post #28

Earlier quoted context omitted.

They're not stored in plaintext, they're stored in the Keychain. The point here is Chrome provides essentially unauthenticated access to the Keychain. For reference, here's what Safari prompts you with when you try to view your saved passwords: http://imgur.com/k2gIqtM

"Unauthenticated" except for the time you told Keychain to "Always allow" requests from Chrome. However I'll admit that there's a big difference between what I expected Chrome to be using those passwords for (logging me into websites) and how it's ended up (making those visible to anyone looking at the settings page).

Why can't Chrome do the same thing Safari does in that image? If the user wishes to see the password in plaintext, ask for their master keychain password first.

Re: Chrome's insane password security strategy

#173

Post by dmaclay » Wed, Aug 07, 2013, 12:33 PM UTC

justinschuh wrote: post #83

elliottkember wrote: post #81

Earlier quoted context omitted.

Hey Justin, I'm the author. I appreciate your sentiments, but I feel like they may be out of touch with the way real people are using computers in the wild. My suggestion is to seriously re-evaluate this approach in light of the actual use-case of how people perceive these passwords. It appears as though many, many users don't expect these passwords to be visible. This is an important thing to take into consideration…

I appreciate how this appears to a novice, but we've literally spent years evaluating it and have quite a bit of data to inform our position. And while you're certainly well intentioned, what you're proposing is that that we make users less safe than they are today by providing them a false sense of security and encouraging dangerous behavior. That's just not how we approach security on Chrome.

This prevents Chrome from ever being my primary browser.

Re: Chrome's insane password security strategy

#174

Post by jperrez » Wed, Aug 07, 2013, 12:34 PM UTC

justinschuh wrote: post #77

I'm the Chrome browser security tech lead, so it might help if I explain our reasoning here. The only strong permission boundary for your password storage is the OS user account. So, Chrome uses whatever encrypted storage the system provides to keep your passwords safe for a locked account. Beyond that, however, we've found that boundaries within the OS user account just aren't reliable, and are mostly just theater.…

OK, it is my fault to leave my laptop unlocked and I'm putting myself at risk by using a browser that let anyone to see my stored passwords in plain-text in a single click...

Re: Chrome's insane password security strategy

#175

Post by simeyla » Wed, Aug 07, 2013, 12:35 PM UTC

justinschuh wrote: post #83

elliottkember wrote: post #81

Earlier quoted context omitted.

Hey Justin, I'm the author. I appreciate your sentiments, but I feel like they may be out of touch with the way real people are using computers in the wild. My suggestion is to seriously re-evaluate this approach in light of the actual use-case of how people perceive these passwords. It appears as though many, many users don't expect these passwords to be visible. This is an important thing to take into consideration…

I appreciate how this appears to a novice, but we've literally spent years evaluating it and have quite a bit of data to inform our position. And while you're certainly well intentioned, what you're proposing is that that we make users less safe than they are today by providing them a false sense of security and encouraging dangerous behavior. That's just not how we approach security on Chrome.

I realized this several years ago and was pretty dumbfounded, and quite surprised I've never read about this until now. Can you explain how the Chrome passphrase works in more detail and why it isn't used in this situation. If I sync my google account to another computer I need to enter a passphrase to sync passwords. Why isn't this asked for when clicking 'Show'? It seems like a perfect additional place. Even if its still 'trivial' to recover passwords you're still going to 'fool' a significant amount of people that it is secure and with Chrome's userbase that is a significant amount of people saved from themselves. And if you're still stubborn and arrogant enough to still make an argument against this then why not just put a damn 'Print my passwords' button on the main toolbar?

Re: Chrome's insane password security strategy

#176

Post by interpol_p » Wed, Aug 07, 2013, 12:36 PM UTC

victorhooi wrote: post #24

panacea wrote: post #10

To those saying this isn't insane... you are wrong. I can open anyone's chrome browser and access their passwords without a master password? That's plain fucked up. (I realise I could visit sites and use password reset, but this is so frictionless as to be insane)

Well, the assumption is, if you cared at all about security, you would actually have a login password, and bother locking your computer? Or you might not just let random people sit down at your laptop and start using it without you being there?

That is not a good assumption.

People care about their security and also care about the convenience of being able to let a friend or co-worker use their computer for seconds or minutes at a time without all their passwords being easily discovered.

If I debug some code on a friend's machine he would not expect me to be able to open his Keychain and read his passwords. I would need a master password for that.

Chrome should do what Safari does — ask for a master password before unmasking other passwords. It would prevent a scenario where one can look up another's passwords inconspicuously and without trace in seconds.

Re: Chrome's insane password security strategy

#177

Post by interpol_p » Wed, Aug 07, 2013, 12:38 PM UTC

kirab wrote: post #14

I’d rather have them show the passwords with a "show" button so the browser doesn’t give the user an idea of a fake security, because the other option would be a pseudo encryption. Most people would think it’s safe while actually someone with a little bit of knowledge could download a tool or even a browser extension which would just dump all stored passwords..

In that case Chrome should clearly tell users that their passwords will be readable at chrome://settings/passwords when it saves a password. Otherwise it's a false sense of security, right?

Re: Chrome's insane password security strategy

#178

Post by jabbajac » Wed, Aug 07, 2013, 12:39 PM UTC

elliottkember wrote: post #81

justinschuh wrote: post #79

Earlier quoted context omitted.

Soft boundaries within the user account do nothing to protect you from exactly those scenarios either. Your protection is to lock your OS user account.

Hey Justin, I'm the author. I appreciate your sentiments, but I feel like they may be out of touch with the way real people are using computers in the wild. My suggestion is to seriously re-evaluate this approach in light of the actual use-case of how people perceive these passwords. It appears as though many, many users don't expect these passwords to be visible. This is an important thing to take into consideration…

Actually, I think it may just be a better idea to prompt for a master password if someone click's show password. Since chrome can be tied to your google account I think using your google account password plus the second verification step before you can show any of the passwords would be a good solution. That way, your passwords are saved, and if you want to see them you need to verify that it's you.

Re: Chrome's insane password security strategy

#179

Post by williambhunt » Wed, Aug 07, 2013, 12:41 PM UTC

elliottkember wrote: post #81

justinschuh wrote: post #79

Earlier quoted context omitted.

Soft boundaries within the user account do nothing to protect you from exactly those scenarios either. Your protection is to lock your OS user account.

Hey Justin, I'm the author. I appreciate your sentiments, but I feel like they may be out of touch with the way real people are using computers in the wild. My suggestion is to seriously re-evaluate this approach in light of the actual use-case of how people perceive these passwords. It appears as though many, many users don't expect these passwords to be visible. This is an important thing to take into consideration…

As an IT professional and tech trainer I do agree with Justin. There is a lot of general education that does need to go on with the public to make them understand this. If Chrome artificially lulled users into a false sense of security it would be just as bad. It's like places that put up fake video cameras and then when someone gets mugged they want to see the footage. The reality for end users is that they should not be storing important passwords to things like banking and most of the other ones can be recovered so easily that weather they are in plain text really makes little difference. Generally everyone has to get better about security and sites with a single layer of authentication like a password are really not all that secure to begin with.

Re: Chrome's insane password security strategy

#180

Post by interpol_p » Wed, Aug 07, 2013, 12:42 PM UTC

nisdec wrote: post #44

At least on Windows, Chrome uses a provided API function which makes the encrypted data only decipherable by the Windows user account used to encrypt the password. So essentially, your master password is your Windows account password. As a result, once you are logged into Windows using your account this data is decipherable by Chrome.

Right but that's really not going to help in most situations.

You've never handed your laptop to a friend to quickly check something on the web?

It would be insulting if you were to explicitly logout whenever someone wants to use your computer for a few seconds / minutes. This flaw makes it easy to view passwords in seconds, and makes it easy to do so in an inconspicuous manner.

It's a user interface failing more than a security issue.