Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Anyone can steal all of chrome saved passwords, form fields, bookmarks, history

medium.com

Post reply on HN
Print view View original

1–10 of 22 posts

Re: Anyone can steal all of chrome saved passwords, form fields, bookmarks, history

#4

Post by ineedasername »

The bug response was laughable "yes with unrestricted acess to an account you can steal data from it".

This makes it sound like "with enough time and patience anything is possible"

But the steps described aren't even what i would call a hack. You could do them by accident if you were trying to log in to your own account under someone elses computer using chrome, in less than a minute if you're quick. It requires no technical knowledge and can be done with time to spare during someone's bathroom break.

Here's the process in a nutshell:

1) logout of their account in chrome.

2) login to you're account

3) lie and say you were the previous per person

This isn't a hack. There is no hack! This is a very small step above the "honor system" as your security!

Re: Anyone can steal all of chrome saved passwords, form fields, bookmarks, history

#5

Post by stcredzero »

smn1234 wrote: post #2

that's a walkthrough anyone can follow. When the barrier to entry for "hacking" credentials and sensitive information is so low, the world's really in trouble...

It's the thats-not-my-problem response that worries me the most.

Re: Anyone can steal all of chrome saved passwords, form fields, bookmarks, history

#7

Post by stcredzero »

yegle wrote: post #6

When an attacker can gain access to your unlocked computer and have time to logout/login your browser, you should not expect anything on the desktop is safe. Personally I don't see this as a security bug.

They should at least have to go to an effort commensurate with installing a keylogger or something like that. Just navigating a few windows to get to see your passwords -- that's just wrong. Anything that has what's supposed to have a secure login shouldn't be exposing passwords like this.

Re: Anyone can steal all of chrome saved passwords, form fields, bookmarks, history

#8

Post by Communitivity »

This is not a new phenomenon, though the ease of the exploit might be new. I remember a while ago you could go in SQLite and look at the file Firefox stored all the saved passwords in, for any user. That exploit was fixed, and this one likely will be as well. I agree with other commenters, the most disturbing thing about this is the blase attitude of the response.

Re: Anyone can steal all of chrome saved passwords, form fields, bookmarks, history

#9

Post by ineedasername »

yegle wrote: post #6

When an attacker can gain access to your unlocked computer and have time to logout/login your browser, you should not expect anything on the desktop is safe. Personally I don't see this as a security bug.

This "hack" takes all of a minute and provides access not to the data on the desktop, but to every website or web based login used, if the user relies on chrome for such things. This isn't "if a thief is physically in your data center you've already lost". This is "I went three doors down to the vending machine for a soda and Oh My God they got my bank account credit cards and all my social media"
Post reply on HN