Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome's insane password security strategy

blog.elliottkember.com

Post reply on HN
Print view View original

201–210 of 315 posts

Re: Chrome's insane password security strategy

#201

Post by LauRoman »

interpol_p wrote: post #169
SonicHedgehog wrote: post #132

Earlier quoted context omitted.

However, Pidgin “would encourage integration with keyrings” [0]. At least on OS X Chrome uses the integrated keychain and as Elusive mentioned [1] it apparently does encrypt passwords on Windows too. So, I think Pidgin’s situation is a bit different and if they would have keychain integration they may solve this differently than Chrome does right now. [0]: https://developer.pidgin.im/wiki/PlainTextPasswords#Isthatth.…

On OS X Chrome pulls the passwords out of the keychain and then makes them completely accessibly in plaintext through the settings/passwords page. I have no idea why it does this.

How open of a platform is that keychain, and can Apple reserve the right to lock any aplication out?

Re: Chrome's insane password security strategy

#202

Post by [deleted] »

justinschuh wrote: post #79
madaxe wrote: post #78

Earlier quoted context omitted.

But it is a false sense of security. Joe User doesn't know a thing about how this magical box of tricks called a computer works. He just assumes that his data is safe on it, and won't get into the wrong hands, and that his passwords will always be protected by asterisks or what-not. Sure, you may encrypt them using keychain, which is good, and yes, if someone has physical access to their machine and user account then…

Soft boundaries within the user account do nothing to protect you from exactly those scenarios either. Your protection is to lock your OS user account.

[deleted]

Re: Chrome's insane password security strategy

#203

Post by victorhooi »

stephenr wrote: post #73
victorhooi wrote: post #21

tl;dr - You're holding it wrong. Seriously, is the HN audience really that non-technical these days? Lol. I don't know what the clown who wrote that post is thinking, or the person that submitted it was, but seriously, how the heck did you think password storage works? It's like when everybody got up in arms about Pidgin storing passwords in cleartext. Heck, they even made a page explaining the rationale: https://dev…

I don't know what you're thinking. Storing multiple encrypted passwords behind a single "master" password (in the case of Windows and OSX its usually the OS level User password) is a common way to provide convenience and security for users.

Well, that's what a login password and a lockscreen are for. I mean, these things are secure and well-tested - I'm not sure why people aren't using them?

Do you somehow think that your OS is more insecure?

I don't think you've exactly explained what exactly you're trying to protect against.

Is it casual attacker who happen to chance upon an unattended computer? Well, in that case, either your computer is locked, or it's pretty much game over.

There is no additional security you can get by just obfuscating it.

Re: Chrome's insane password security strategy

#204

Post by grscjo3 »

elliottkember wrote: post #81
justinschuh wrote: post #79

Earlier quoted context omitted.

Soft boundaries within the user account do nothing to protect you from exactly those scenarios either. Your protection is to lock your OS user account.

Hey Justin, I'm the author. I appreciate your sentiments, but I feel like they may be out of touch with the way real people are using computers in the wild. My suggestion is to seriously re-evaluate this approach in light of the actual use-case of how people perceive these passwords. It appears as though many, many users don't expect these passwords to be visible. This is an important thing to take into consideration…

Why do you know better how people use it in the wild than Google? Don't they gather usage data from the browser? Maybe have the muscle to conduct large-scale interviews?

Re: Chrome's insane password security strategy

#205

Post by rmc »

ds wrote: post #98
justinschuh wrote: post #77

I'm the Chrome browser security tech lead, so it might help if I explain our reasoning here. The only strong permission boundary for your password storage is the OS user account. So, Chrome uses whatever encrypted storage the system provides to keep your passwords safe for a locked account. Beyond that, however, we've found that boundaries within the OS user account just aren't reliable, and are mostly just theater.…

Nobody doubts that adding a master password will stop nobody who knows what they are doing. If someone has access to your computer and wants to do damage, they have full access to do it. However, keep in mind 'open door' syndrome. A crime of opportunity is very different than one of bad intentions. Leave a car unlocked with a $20 bill on the seat and you might find that $20 gone when you return. Now, if you lock the…

A potentially honest person might open a door and take something

I actually don't think this is the case. An honest person would not open a car door if they saw a note in the car. Sure crooks and theives would, but honest people don.t

As a counter-example, just look at what happens sometimes when you lose your phone or wallet. Oftentimes you get it back. A lot of people are honest.

Re: Chrome's insane password security strategy

#206

Post by d0x720 »

elliottkember wrote: post #87
justinschuh wrote: post #86

Earlier quoted context omitted.

It matters that you don't seem to understand the threat model here. You think your passwords are protected somehow in other applications, but they're simply not. The fact is that they're still trivially recoverable, and if the bad guy can read them at all than he already has access to fully compromise your entire OS user account. So, you're arguing that we take measures to make users think they're safe when they've a…

You're right, locking the operating system will secure it. But people aren't doing that. And people lend their computers to friends sometimes. It happens. I think the actual situation is that you don't understand how people are using computers, and how people expect them to behave - which is very important. Your software allows me to open up one application and see all passwords. It's likely the single most-used appl…

Wrong. Who cares if chrome shows the password? If someone has access to the browser with saved passwords they can easily just go to a site that's been saved and login and change said password so having chrome not show the PW would do ABSOLUTELY NOTHING

Re: Chrome's insane password security strategy

#207

Post by rmc »

interpol_p wrote: post #170
justinschuh wrote: post #77

I'm the Chrome browser security tech lead, so it might help if I explain our reasoning here. The only strong permission boundary for your password storage is the OS user account. So, Chrome uses whatever encrypted storage the system provides to keep your passwords safe for a locked account. Beyond that, however, we've found that boundaries within the OS user account just aren't reliable, and are mostly just theater.…

You say you do not wish to lull users into a false sense of security. So why not clearly tell people each time Chrome saves a password that the saved password will be visible in plaintext by visiting chrome://settings/passwords ? Otherwise you are lulling people into a false sense of security. E.g., to view passwords in my coworker's Keychain, I have to at least enter their account password to show the plaintext. To…

So why not clearly tell people each time Chrome saves a password that the saved password will be visible in plaintext by visiting chrome://settings/passwords ?

Because the vast majority of the population don't know what a browser is, let alone a URL.

You (the developer) are providing the illusion of consent. The person don't know what just happened, but you're inferring that they have consented to what it showing up in that url.

Re: Chrome's insane password security strategy

#208

Post by itcmcgrath »

justinschuh wrote: post #77

I'm the Chrome browser security tech lead, so it might help if I explain our reasoning here. The only strong permission boundary for your password storage is the OS user account. So, Chrome uses whatever encrypted storage the system provides to keep your passwords safe for a locked account. Beyond that, however, we've found that boundaries within the OS user account just aren't reliable, and are mostly just theater.…

We also know bullet proof vests are not absolute protection, but you don't see the police/military throwing up their hands and not issuing and wearing them because 'someone determined could kill you anyway'.

The point is that it would prevent a certain number of attacks (such as non technical mischievous people) from unpremeditated attacks.

Your comment about 'false sense of security' is completely out of place as well. Chrome currently isn't doing anything to prevent the false sense of security (obviously from all the surprised people out there - can you see it now?). Why does it have to be a mutually exclusive choice? You could have your 'master password' and still have your false sense of security disclaimer displayed prominently next to it as well.

Re: Chrome's insane password security strategy

#209

Post by interpol_p »

victorhooi wrote: post #200
interpol_p wrote: post #176

Earlier quoted context omitted.

That is not a good assumption. People care about their security and also care about the convenience of being able to let a friend or co-worker use their computer for seconds or minutes at a time without all their passwords being easily discovered. If I debug some code on a friend's machine he would not expect me to be able to open his Keychain and read his passwords. I would need a master password for that. Chrome sh…

Err, I think that's a bit of a strawman fallacy. If you leave your computer unlocked in a public area, that's asking for trouble - which is the example I was referring to. However, in your example, you cited giving your machine to a friend to debug code - in that case, you either trust your friend, or you don't. If you don't trust your friend, why are you giving them your machine then. It's like asking your friend to…

Have you ever glanced slightly harder than you should when your friend enters their four digit pin code on their phone? I have. And it's not out of malicious intent.

There are levels of trust. It's not binary, and it's not as simple as you make it out to be.

Because Chrome presents your passwords in an easily accessible list from the settings screen, it lowers the barrier to access and increases the opportunity for passwords to be read.

Maybe my friend wants to read my passwords out of idle curiosity and they won't do anything malicious with them. I don't know, and I don't want to find out.

It is not at all like asking your friend to collect your mail. First, you can easily see if your mail has been opened. And for your friend to "cover up" opening your mail they would have to have some serious intent to breach your trust. This is not so with the password screen in Chrome.

I'm surprised that you can't see how making the passwords to all your websites easily accessible and readable in a convenient list is a bad thing. Adding a simple hurdle to access is all that's needed to prevent the majority of casual peeking at peoples' passwords. Safari does this, there is no technical reason Chrome can't.

Re: Chrome's insane password security strategy

#210

Post by madaxe »

DanBC wrote: post #187
madaxe wrote: post #95

Earlier quoted context omitted.

I can see you don't, which is why I'm trying to pose it variously. It's a simple one: why make it easier for a user to be compromised than is necessary? Why is it such a problem to ask the user to enter their account password before viewing this prefpane? You've not provided a valid argument against this. As to lulling users - they already are. All of your marketing screams about how secure chrome is, how you don't n…

> Why is it such a problem to ask the user to enter their account password before viewing this prefpane? You've not provided a valid argument against this. Most users do not have to enter their password when their OS boots, and thus won't know what it is. So offering it in Chrome is an inconvenience for most users, but adds no extra security. Once an attacker has physical access and can run Chrome browser it's game o…

Again, missing the point. Both your average attacker and average user have as much technical knowledge as a daffodil, which means even the most trivial barrier would be effective.

As to users who don't set a password - never make the passwords visible.

Post reply on HN