Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft Edge stores all passwords in memory in clear text, even when unused

twitter.com

Post reply on HN
Print view View original

11–20 of 243 posts

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#11

Post by sedatk »

WolfeReader wrote: post #9

Please use a dedicated password manager, instead of a browser-based one. KeePass is likely the best going forward.

@taviso had claimed the exact opposite: https://lock.cmpxchg8b.com/passmgrs.html

EDIT: Yes, he claimed that for online password managers, not keepass. I thought the argument was about password managers in general.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#12

Post by turtlebits »

gruez wrote: post #4

This feels like a case of "It rather involved being on the other side of this airtight hatchway"[1]. If you can read arbitrary process memory, you're probably also in a position to just dump out the passwords by pretending to be the user in question. > If an attacker gains administrative access on a terminal server, they can access the memory of all logged‑on user processes. If an attacker has administrative access,…

Security isn't black and white. If i leave a post-it note of my logins on my monitor, that's definitely less safe than in a unlocked drawer, and so on.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#14

Post by riedel »

kleiba2 wrote: post #5

Does this tool access an Edge instance running on the same machine? Couldn't you then just simply export all saved passwords anyway? https://support.microsoft.com/en-us/topic/export-passwords-i...

Password managers often go through quite some hassle to keep passwords 'safe' in memory. However, I often do not get the attack model of many of those tools. Tools like keepass e.g. go through quite to register a browser plugin. But then anyone with normal user rights can extract that key from the browser and do everything with it. Also this whole 'trust this browser' stuff of web apps seems strange if one e.g. can read the cookie store easily...

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#15

Post by echelon_musk »

sedatk wrote: post #11
WolfeReader wrote: post #9

Please use a dedicated password manager, instead of a browser-based one. KeePass is likely the best going forward.

@taviso had claimed the exact opposite: https://lock.cmpxchg8b.com/passmgrs.html EDIT: Yes, he claimed that for online password managers, not keepass. I thought the argument was about password managers in general.

Where?

> Good examples of simple and safe password managers are keepass and keepassx

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#16

Post by Someone1234 »

WolfeReader wrote: post #9

Please use a dedicated password manager, instead of a browser-based one. KeePass is likely the best going forward.

If it is a process, running in the same user context, with the ability to read/dump arbitrary memory -- As the KeePass database is decrypted it would "store all passwords in memory in plain text" too.

The fix isn't Edge Vs. Chrome. Vs KeePass Vs. Bitwarden, it is "How do I have my passwords exist in a different execution context than [evil process able to read all memory]?"

Android and iOS have an "answer" to this problem. Desktop OSs having all processes running side by side in the user's execution context, do not. It is only as secure as the least secure process running.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#17

Post by WolfeReader »

75central wrote: post #10
WolfeReader wrote: post #9

Please use a dedicated password manager, instead of a browser-based one. KeePass is likely the best going forward.

Out of curiosity, why KeePass versus Bitwarden? I've been using Bitwarden for years, but if there's a specific reason I should be using KeePass instead, I'm open to changing.

Bitwarden has taken investor money, sadly. It's still in good shape for the moment. But the time will come when they place profits above other needs; it's a matter of when, not if.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#19

Post by busterarm »

sedatk wrote: post #11
WolfeReader wrote: post #9

Please use a dedicated password manager, instead of a browser-based one. KeePass is likely the best going forward.

@taviso had claimed the exact opposite: https://lock.cmpxchg8b.com/passmgrs.html EDIT: Yes, he claimed that for online password managers, not keepass. I thought the argument was about password managers in general.

That's not what that is saying. It's saying don't use an _online_ password manager instead of the browser one. In the very opening they state that simple implementations are great and even lists some. Then the rest of the article dives specifically into online password managers, which are something else.
Post reply on HN