Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome's insane password security strategy

blog.elliottkember.com

Post reply on HN
Print view View original

301–310 of 315 posts

Re: Chrome's insane password security strategy

#301

Post by asveikau »

sequoia wrote: post #120
elliottkember wrote: post #81

Earlier quoted context omitted.

Hey Justin, I'm the author. I appreciate your sentiments, but I feel like they may be out of touch with the way real people are using computers in the wild. My suggestion is to seriously re-evaluate this approach in light of the actual use-case of how people perceive these passwords. It appears as though many, many users don't expect these passwords to be visible. This is an important thing to take into consideration…

fwiw Pidgin takes this same approach for the same reasons. https://developer.pidgin.im/wiki/PlainTextPasswords "locking" the passwords would require intermittent master-pass entry like `sudo`, this would come off as an inconvenience to many users. I think people here miss the fact that many users, even if they say they want more security, are unwilling to give up convenience and will switch platforms (i.e. browsers)…

I was floored that they let such an ignorant comment into the first paragraph:

> This is somewhat controversial in Windows, due to its weak file protections, but that's the way things are.

I read this as: we haven't bothered to look into the APIs for this... The Windows file permission model is a lot more granular than the "uid/gid/other" that most people are familiar with from Unix. Maybe this is a problem if you install to FAT32, which Windows disallowed since 2006.

Edit:

Apparently the text used to be:

> This is somewhat controversial in Windows, especially Windows 98 due to its weak file protections, but that's the way things are.

A user MarkDoliner then wrote:

> We no longer support Windows 98, so don't mention it.

But somehow in his editing neglected to make it a true statement.

Re: Chrome's insane password security strategy

#302

Post by lvs »

filipmares wrote: post #135
elliottkember wrote: post #81

Earlier quoted context omitted.

Hey Justin, I'm the author. I appreciate your sentiments, but I feel like they may be out of touch with the way real people are using computers in the wild. My suggestion is to seriously re-evaluate this approach in light of the actual use-case of how people perceive these passwords. It appears as though many, many users don't expect these passwords to be visible. This is an important thing to take into consideration…

I think Justin's arguments are fair. The reality is that you're using the browser under a certain user profile. If you want to really separate your data from other users using your computer i would suggest icognito sessions or creating different user profiles. If you share your user profile (active user) you expose all this data (bookmarks, extensions, passwords). Seems logical to me https://www.dropbox.com/s/kgrrtil…

Average people do not have the time, knowledge, or interest to do what you and Justin propose. Chrome is exposing what is arguably the very (very!) large majority of users who will never have the wherewithal to individually concoct an infosec strategy for their machines.

Re: Chrome's insane password security strategy

#303

Post by teeja »

papacity wrote: post #300
mullingitover wrote: post #288

Earlier quoted context omitted.

> In Firefox you can go to preferences, security, and saved passwords. Incorrect if you set a master password, which Firefox allows you to do and is the reason why everyone's saying 'wtf, chrome?' and leaving firefox alone.

IF you set a master password... But how many people do that? By the way, you can set up user profiles in Chrome.

How many? ALL the smart people.

As for the dumb ones, they're storing their passwords on a sticky-post. Or using Chrome.

Re: Chrome's insane password security strategy

#304

Post by teeja »

elliottkember wrote: post #81
justinschuh wrote: post #79

Earlier quoted context omitted.

Soft boundaries within the user account do nothing to protect you from exactly those scenarios either. Your protection is to lock your OS user account.

Hey Justin, I'm the author. I appreciate your sentiments, but I feel like they may be out of touch with the way real people are using computers in the wild. My suggestion is to seriously re-evaluate this approach in light of the actual use-case of how people perceive these passwords. It appears as though many, many users don't expect these passwords to be visible. This is an important thing to take into consideration…

Dear Google guy: better give it up, you're only digging your hole deeper.

Re: Chrome's insane password security strategy

#306

Post by mullingitover »

papacity wrote: post #300
mullingitover wrote: post #288

Earlier quoted context omitted.

> In Firefox you can go to preferences, security, and saved passwords. Incorrect if you set a master password, which Firefox allows you to do and is the reason why everyone's saying 'wtf, chrome?' and leaving firefox alone.

IF you set a master password... But how many people do that? By the way, you can set up user profiles in Chrome.

That's not the point. The point is that Chrome lacks this option, which, again, is why nobody's heckling Firefox right now. This isn't a thread about people failing to configure their software, it's a thread about a popular piece of software that's bungling some trivial security features.

Re: Chrome's insane password security strategy

#307

Post by interpol_p »

hellerbarde wrote: post #295
interpol_p wrote: post #286

Earlier quoted context omitted.

And you have completely missed the point here. It requires a stronger level of intent for someone to dump my Keychain passwords than it does for someone to browse my Chrome passwords. This concerns me. I have friends that I would not trust around my computer now because I know that going to chrome://settings/passwords is too tempting for them. But I trust them not to maliciously or actively attempt to subvert the sec…

And you missed the point also. Lock your computer when you're not at it. Like any responsible user. Problem solved. It's not hard to understand where the boundaries are. Also, it's actually up to Apple to fix the broken thing, not Chrome. There should be a settings in the preferences of the keychain to require a password even if it's been unlocked before (or however that works. I don't Mac)

Three points:

1. I do not lock my computer when my friend comes along to debug code on it. I do not lock my computer when I pass it to a friend at home so he can look something up. With Safari's password storage, I have a reasonable expectation that my passwords will not be viewed in the 30 seconds or so that I let people use my computer.

2. Keychain is not broken. Safari requires your Keychain password every time you wish to unmask a password. Chrome could easily do this too.

3. Chrome lowers the barrier-to-access for passwords. It reduces the amount of intent required. I would feel less bad going up to a friend's computer and browsing their Chrome passwords than, say, allowing Chrome to auto-fill a password on their computer and running a script to modify the DOM elements to reveal it. The latter is a more serious breach of trust, implies stronger malicious intent, and is more traceable.

Chrome would be better if it implemented this. I have yet to hear how this will make Chrome worse in any way. Why do you not want Chrome to be better?

Re: Chrome's insane password security strategy

#308

Post by marshray »

ronaldx wrote: post #136
kpop312 wrote: post #129

Earlier quoted context omitted.

If chrome ever removes that setting, I will make chromereveal.com with one-click idiot-proof password dumping tool, and step-by step instructions. So hiding that button will not make it harder for your friends. Just logout and give them guest access...geez.

that does make it psychologically harder - I have to go to a site with clear malicious intention, rather than pay a visit to a setting which the browser itself provides.

Classic security theater.

Re: Chrome's insane password security strategy

#309

Post by marshray »

thisusername wrote: post #146
mullingitover wrote: post #131

Earlier quoted context omitted.

>If you don't want people browsing your passwords, you can't ever give them access to your user account or your unlocked desktop. That's it, that is the entire solution. Nope. Just don't use Chrome. That's an even better solution.

Hahahahahhhh. Let me teach you a neat trick (I'll use firefox as an example, but this can be done in any browser because it's a "feature" of HTML). >Open firefox and navigate to a login page where your password is saved >Right click on password box and click inspect element >In the console, change type="password" to type="" >Move your eyes back to the password field Oh dear, what's this?! Protip: Don't store your pas…

Thanks. By chance, I needed to recover a password (one of my own of course) today and I remembered that trick.

Re: Chrome's insane password security strategy

#310

Post by boklm0 »

Throwadev wrote: post #122
brown9-2 wrote: post #115

Earlier quoted context omitted.

Please don't invent motivations for the statements people make when you don't like what they've stated so far. If you don't want people browsing your passwords, you can't ever give them access to your user account or your unlocked desktop. That's it, that is the entire solution. Any other method of protecting the passwords is vulnerable as long as the potential attacker has physical access to the unlocked desktop. No…

Right, I'm not arguing against any of that. The point is if it's going to be that insecure, Chrome should make more of an effort to make it clear. They could do this by displaying a warning alongside the prompt to save a password. Also, just because some people will be able to access the passwords with physical access doesn't mean it's not worth doing basic/unsecure locking. I'd rather use a system where people need…

"The point is if it's going to be that insecure, Chrome should make more of an effort to make it clear"

And what's a better way to make it clear than actually showing the passwords ?

Post reply on HN