Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft Edge stores all passwords in memory in clear text, even when unused

twitter.com

Post reply on HN
Print view View original

111–120 of 243 posts

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#111

Post by thewebguyd »

cj00 wrote: post #103
aslihana wrote: post #99

Correct me if I am wrong but chrome is-at least was- keeping passwords as raw text in Windows too. I got friend's forgotten password from Chrome on 2021 version

Yeah it's been years but I remember seeing arguments with Google devs saying if someone had access to your local file system, you're already SOL.

I've always hated that argument. Yes, if someone as access to your local file system, you are already SOL, but if that machine is part of an org, they aren't necessarily SOL except for now those plain text passwords can potentially be used for easier lateral movement to hit other, more privileged accounts (if you had access/had them saved in that password manager). At minimum, those credentials can now be used to phish the rest of your organization.

Stopping the spread is just as important as protecting any individual machine.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#113

Post by asdfman123 »

gruez wrote: post #4

This feels like a case of "It rather involved being on the other side of this airtight hatchway"[1]. If you can read arbitrary process memory, you're probably also in a position to just dump out the passwords by pretending to be the user in question. > If an attacker gains administrative access on a terminal server, they can access the memory of all logged‑on user processes. If an attacker has administrative access,…

So you're saying it's an Edge case?

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#114

Post by RajT88 »

slow_typist wrote: post #89
cachius wrote: post #82

Earlier quoted context omitted.

The Swiss cheese model. Each single layer has holes, but when stacked the combined hole area is minimized https://en.wikipedia.org/wiki/Swiss_cheese_model

The Swiss cheese model is what people use to sell you more 'security' related software systems that inherently involve more problems. (Also cheese is not very durable, even the kind without holes.)

[dead]

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#115

Post by maxloh »

gruez wrote: post #4

This feels like a case of "It rather involved being on the other side of this airtight hatchway"[1]. If you can read arbitrary process memory, you're probably also in a position to just dump out the passwords by pretending to be the user in question. > If an attacker gains administrative access on a terminal server, they can access the memory of all logged‑on user processes. If an attacker has administrative access,…

This logic is perfectly aligned with the Chromium threat model. Once an attacker gains administrator access, it is game over by definition.

I doubt this is an Edge-specific issue. Microsoft has no interest in making their browser less secure than its upstream.

> Why aren‘t physically-local attacks in Chrome’s threat model?

> We consider these attacks outside Chrome's threat model, because there is no way for Chrome (or any application) to defend against a malicious user who has managed to log into your device as you, or who can run software with the privileges of your operating system user account. Such an attacker can modify executables and DLLs, change environment variables like PATH, change configuration files, read any data your user account owns, email it to themselves, and so on. Such an attacker has total control over your device, and nothing Chrome can do would provide a serious guarantee of defense. This problem is not special to Chrome ­— all applications must trust the physically-local user.

https://chromium.googlesource.com/chromium/src/+/148.0.7778....

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#116

Post by xaduha »

jazzyjackson wrote: post #56
Someone1234 wrote: post #16

Earlier quoted context omitted.

If it is a process, running in the same user context, with the ability to read/dump arbitrary memory -- As the KeePass database is decrypted it would "store all passwords in memory in plain text" too. The fix isn't Edge Vs. Chrome. Vs KeePass Vs. Bitwarden, it is "How do I have my passwords exist in a different execution context than [evil process able to read all memory]?" Android and iOS have an "answer" to this pr…

Windows 11* and MacOS also do the job as long as you're using hardware bound passkeys. * I don't want to speak past my own experience so checking my work, Windows can store passkeys in a TPM if available but falls back to storing on disk... https://helgeklein.com/blog/checking-windows-hello-for-busin...

I was looking for an answer to this when it comes to using Edge password manager in particular, it uses Windows Hello as far as I know and while it does make 'synced' passkeys they don't seem to be usable anywhere than the original machine. Useful when reinstalling Windows at least.

https://yourpasskeyisweak.com does not mention Edge.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#117

Post by themaninthedark »

Someone1234 wrote: post #57
jazzyjackson wrote: post #51

Earlier quoted context omitted.

One more reason to use hardware-bound passkeys and not passwords.

True. But then your hardware dies, and you're locked out of every account you own. It is objectively good security, but has a ton of usability headaches yet to be really solved. I've seen orgs move to passkeys only, then offer reset-questions (e.g. city of first job, etc); because the Customer Service volume/workflow wasn't figured out.

At my work we required a complex password Updated to Windows Hello and passkey.

Now I can use a 4 digit pin to login.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#118

Post by stouset »

StilesCrisis wrote: post #108
stouset wrote: post #101

Earlier quoted context omitted.

Your password manager almost certainly already has baked-in passkey support.

It does, but what's your point? Why should I redo everything?

Nobody is asking you to?

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#119

Post by crazygringo »

stouset wrote: post #118
StilesCrisis wrote: post #108

Earlier quoted context omitted.

It does, but what's your point? Why should I redo everything?

Nobody is asking you to?

The subject here is literally websites trying to push passkeys on users. That is who is asking us to.

About every week now Amazon tries to trick me into creating a passkey. It doesn't even ask, it just goes ahead and triggers my browser passkey creation mechanism without my consent. PayPal recently tried to force me to create one too and I had to kill and restart the app because that was the only way to skip it. I'll stick to my password with 2FA, thanks.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#120

Post by wat10000 »

yjftsjthsd-h wrote: post #54
turtlebits wrote: post #12

Earlier quoted context omitted.

Security isn't black and white. If i leave a post-it note of my logins on my monitor, that's definitely less safe than in a unlocked drawer, and so on.

Okay. Can you describe an attack / threat model where it would matter in this particular case?

https://en.wikipedia.org/wiki/Spectre_(security_vulnerabilit...
Post reply on HN