Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome's insane password security strategy

blog.elliottkember.com

Post reply on HN
Print view View original

241–250 of 315 posts

Re: Chrome's insane password security strategy

#241

Post by destiny14 »

justinschuh wrote: post #77

I'm the Chrome browser security tech lead, so it might help if I explain our reasoning here. The only strong permission boundary for your password storage is the OS user account. So, Chrome uses whatever encrypted storage the system provides to keep your passwords safe for a locked account. Beyond that, however, we've found that boundaries within the OS user account just aren't reliable, and are mostly just theater.…

Justin, I don' t understand why you have to think only from a hacker' s point of view. Now this thing has got so much publicity that one of my colleagues in the office can simply come to my desk whilst I' m away to grab a coffee and steal my Facebook password? How simple is that and what are the implications?

Re: Chrome's insane password security strategy

#242

Post by marcgg »

corobo wrote: post #181
marcgg wrote: post #105

Earlier quoted context omitted.

I understand that a master password would just lead the user into a false sense of security. However, I feel that it should be make as hard as possible to find the user's password. A good safe is judged by the time required to break it. There is no safe that is unbreakable, you just need to put enough time, effort and noise to open it. Same thing could be applied here. Installing software, dump the cookies and so on…

"My point here is that there is little to no value" Personally speaking I've had plenty of occasions where I've logged into a site and saved the password then later Chrome doesn't recognise where to put the credentials on another page on the site (e.g. a header login vs a separate login page) - In those cases I'd rather just look to see what the password is and re-enter it than go through a password reset process.

I tend to have ways to remember passwords, so I never need this, but ok your use case makes sense. Thanks for sharing!

Re: Chrome's insane password security strategy

#243

Post by Jayku1 »

euyyn wrote: post #224
bashinator wrote: post #126

Earlier quoted context omitted.

If you don't want to lull your users into a false sense of security, then why doesn't the "save password?" dialog have a disclaimer reading, "All saved passwords can be viewed at chrome://settings/passwords". This simple notification would go a long way towards raising the level of awareness you seem to assume the average person already has.

Then they might chose to use IE instead, which doesn't show that disclaimer yet is no different. The teaching that needs to be done is that letting a bad guy access your computer unlocked is game over.

Are you on XP with IE6 or something? IE uses the Windows credential store nowadays, which requires you to reenter your logon password before it will expose your password....

Re: Chrome's insane password security strategy

#244

Post by marcgg »

phablet wrote: post #217
corobo wrote: post #199

Earlier quoted context omitted.

Changing the password is a fair point that I hadn't considered

I think that most people on here haven't considered this. In fact, I arrived at your comment by searching the page for "reset". The majority of folks seem too focused on trying to outclass Justin and/or getting in the last word. They're not thinking. Just for fun, I went to see how many licks it actually does take to get to the center of a tootsie roll pop i.e., clicks to reveal a password using the passwords dialog…

I'm not trying to outclass anyone, I'm simply not sure that this is the right solution and so far I'm fully convinced by what he said. I'm sure he's way smarter than I and I'm probably missing something. Take everything I say as it is: a comment on the internet.

This being said, security through obscurity is never an optimal solution, but again going back to my "safe" analogy (not unbreakable, just hard to break). If a hacker wants to change the password, it takes a few clicks to locate a site where the user could be logged in. Then the clicks required to get a new password. Add the delay of email reception and so on... It takes more time and effort to do that than just click "show me all the passwords" and take a photo with a smartphone. Plus doing so will give you 1 password only.

About the keyboard presses count, let's say I use both mouse and keyboard.

ctrl+, (shortcut to settings) click to advanced click to manage click show

It's 4 operations. In my opinion, it's way shorter to do that and get ALL the passwords of a given user than try to change the Facebook password. Again, and I'm really stressing this out, it's not about making an unbreakable system. It's just making it a bit harder to break.

Re: Chrome's insane password security strategy

#245

Post by papacity »

elliottkember wrote: post #84
justinschuh wrote: post #83

Earlier quoted context omitted.

I appreciate how this appears to a novice, but we've literally spent years evaluating it and have quite a bit of data to inform our position. And while you're certainly well intentioned, what you're proposing is that that we make users less safe than they are today by providing them a false sense of security and encouraging dangerous behavior. That's just not how we approach security on Chrome.

Novice? I'm sorry, but whether I'm a novice has absolutely nothing to do with this. What I'm proposing is that you just don't show our passwords, all in one window, in plain text. I agree that this won't solve the problem, but would be a good first step. And I don't see how that would be dangerous. Alternatively, Chrome should make this more obvious so that users don't make assumptions about its security. How on eart…

You sound like an angry OS X / iOS developer trying to make a name for himself. This is old news, and I find it odd how you've decided to focus all of the attention on Chrome even though other browsers operate in a similar way. And frankly, if you’re dumb enough to let someone use your computer, after you've knowingly saved your passwords on it, you deserved to get hacked. Operating system profiles should be common knowledge by now.

Re: Chrome's insane password security strategy

#246

Post by Jayku1 »

zestyping wrote: post #142
justinschuh wrote: post #83

Earlier quoted context omitted.

I appreciate how this appears to a novice, but we've literally spent years evaluating it and have quite a bit of data to inform our position. And while you're certainly well intentioned, what you're proposing is that that we make users less safe than they are today by providing them a false sense of security and encouraging dangerous behavior. That's just not how we approach security on Chrome.

Seeing the data would be pretty convincing. Could you please share the data that leads you believe that: - Showing passwords in this fashion is consistent with most users' expectations about how their passwords can be accessed. - Requiring authentication before showing passwords has the effect of encouraging people to leave their computers unlocked in a potentially hostile environment.

I think the data in question is more likely to be feature usage statistics of the sort that show that when a browser does has a master password option, something less than 2% of users set it, and half of those unset it after they realize they're going to be prompted for it over and over and over all day.

Re: Chrome's insane password security strategy

#247

Post by Jayku1 »

justinschuh wrote: post #77

I'm the Chrome browser security tech lead, so it might help if I explain our reasoning here. The only strong permission boundary for your password storage is the OS user account. So, Chrome uses whatever encrypted storage the system provides to keep your passwords safe for a locked account. Beyond that, however, we've found that boundaries within the OS user account just aren't reliable, and are mostly just theater.…

If Chrome uses "whatever encrypted storage the system provides" why aren't the credentials stored in the OSX keychain or the Windows Credential Manager, where the user has to re-enter their login password to see them...

Re: Chrome's insane password security strategy

#248

Post by TheloniousMong »

Throwadev wrote: post #92
elliottkember wrote: post #87

Earlier quoted context omitted.

You're right, locking the operating system will secure it. But people aren't doing that. And people lend their computers to friends sometimes. It happens. I think the actual situation is that you don't understand how people are using computers, and how people expect them to behave - which is very important. Your software allows me to open up one application and see all passwords. It's likely the single most-used appl…

Elliottkmember is right here. Chrome's approach to this is absurd. What if you simply don't want friends, coworkers, significant others browsing your passwords? At least tell users that if they choose to save passwords in Chrome, that everyone who uses their computer, even pretty non-technical people, will be able to access those passwords. Tell them that storing their passwords in Chrome is unsafe. Justin, can you t…

The real reason is simple. Get people to fear their real life circles so that, by contrast, they'll be more inclined to share their private information on the Internet.

After all, google's business model depends directly on how much private information is shared over much of the internet.

Re: Chrome's insane password security strategy

#249

Post by arpruss »

jmcentire wrote: post #102
justinschuh wrote: post #86

Earlier quoted context omitted.

It matters that you don't seem to understand the threat model here. You think your passwords are protected somehow in other applications, but they're simply not. The fact is that they're still trivially recoverable, and if the bad guy can read them at all than he already has access to fully compromise your entire OS user account. So, you're arguing that we take measures to make users think they're safe when they've a…

Forgive me for not looking at Chrome's source code on this, but I'm going to go ahead and assume that Chrome doesn't encrypt the passwords on the disk. You can easily do better than this while maintaining all of your current functionality. On my system, I have installed scrypt and use it as a password management tool. When I need a password, I simply run a shell script I created, type my master password, and the pass…

I would worry that after the copy and paste into the browser, copies of the password are found decrypted all over the place in RAM, and then if you don't have whole disc encryption it may creep in plain-text into swap.

Re: Chrome's insane password security strategy

#250

Post by zachw »

elliottkember wrote: post #81
justinschuh wrote: post #79

Earlier quoted context omitted.

Soft boundaries within the user account do nothing to protect you from exactly those scenarios either. Your protection is to lock your OS user account.

Hey Justin, I'm the author. I appreciate your sentiments, but I feel like they may be out of touch with the way real people are using computers in the wild. My suggestion is to seriously re-evaluate this approach in light of the actual use-case of how people perceive these passwords. It appears as though many, many users don't expect these passwords to be visible. This is an important thing to take into consideration…

The clear-text storage of Chrome passwords and the Google devs stubborn refusal to admit that this is a problem is VERY old news.

It has been discussed ad nauseum for years. As is the frequent suggestion to store all passwords via third party utilities or services (keepass, lastpass, etc).

The password protected password manager is the main reason why Firefox remains my primary browser. If my laptop is stolen, I'm confident that my passwords will be safe (although I still do not store banking related passwords.) More info at raidersec.blogspot.com/2013/06/how-browsers-store-your-passwords-and.html

Encrypted passwords are only unlocked in FF during a single browser session after one has entered the master password. Do people not understand this??

Post reply on HN