Microsoft Edge stores all passwords in memory in clear text, even when unused
1–10 of 243 posts
Re: Microsoft Edge stores all passwords in memory in clear text, even when unused
#2To be fair, 'loads into memory' and 'stores' are not the same thing.
Re: Microsoft Edge stores all passwords in memory in clear text, even when unused
#3Why wouldn't it? What else would you expect from the p̶e̶o̶p̶l̶e̶ masochists who subjected us to internet explorer
Re: Microsoft Edge stores all passwords in memory in clear text, even when unused
#4This feels like a case of "It rather involved being on the other side of this airtight hatchway"[1]. If you can read arbitrary process memory, you're probably also in a position to just dump out the passwords by pretending to be the user in question.
> If an attacker gains administrative access on a terminal server, they can access the memory of all logged‑on user processes.
If an attacker has administrative access, they can also attach a debugger to every chrome process and force it to decrypt all the passwords. The only difference this really makes is in coldboot attacks, but even then it's still not clear whether it makes the attacker's job slightly easier, or allows an attack that's otherwise not possible.
[1] https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31...
Re: Microsoft Edge stores all passwords in memory in clear text, even when unused
#5Does this tool access an Edge instance running on the same machine? Couldn't you then just simply export all saved passwords anyway?
https://support.microsoft.com/en-us/topic/export-passwords-i...
Re: Microsoft Edge stores all passwords in memory in clear text, even when unused
#6To be fair, 'loads into memory' and 'stores' are not the same thing.
The headline here says "stores in memory", which sounds pretty much identical to me. Can you elaborate on what you consider the difference between "loading" and "storing" into memory?
Re: Microsoft Edge stores all passwords in memory in clear text, even when unused
#7Re: Microsoft Edge stores all passwords in memory in clear text, even when unused
#8To be fair, 'loads into memory' and 'stores' are not the same thing.
The headline here says "stores in memory", which sounds pretty much identical to me. Can you elaborate on what you consider the difference between "loading" and "storing" into memory?
When someone says passwords are ‘stored’, the assumption will always be ‘stored on disk’. ‘stores in memory’ is not an accurate representation because memory is inherently volatile and they are loaded there temporarily. Plaintext on disk is egregious, plaintext in memory is considerably less so.
Re: Microsoft Edge stores all passwords in memory in clear text, even when unused
#9Please use a dedicated password manager, instead of a browser-based one. KeePass is likely the best going forward.
Re: Microsoft Edge stores all passwords in memory in clear text, even when unused
#10Please use a dedicated password manager, instead of a browser-based one. KeePass is likely the best going forward.
Out of curiosity, why KeePass versus Bitwarden? I've been using Bitwarden for years, but if there's a specific reason I should be using KeePass instead, I'm open to changing.