Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft Edge stores all passwords in memory in clear text, even when unused

twitter.com

Post reply on HN
Print view View original

121–130 of 243 posts

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#121

Post by notepad0x90 »

mixed feelings on this, edge is supposed to store creds via DPAPI to the most part. you should also really not use password saving feature on edge (or any browser), it exposes you to a lot more threats that you need.

But.. saved passwords are not the same thing as "secrets" the browser uses. It has to be able to provide plain text passwords to websites. This is a really bad feature browsers should just not have to begin with, but they do, and I don't see a better way to use this.

In the past, they used to store the passwords in sqlite dbs, but now they've moved away from that at least.

From an attack perspective, there maybe some instances where you can dump memory, but you can't attach a debugger to the process without getting caught. so it does make a little bit of a difference there, but microsoft will probably tell you this isn't a security boundary that's being crossed. They can store it via DPAPI in lsass, and if lsass isolation is enabled (only on physical computers, default on win11) even SYSTEM privilege won't get you the credentials.

But what's the idea here, you have access to the browser, but you can't visit the site the password is saved for to make it "in use" and in plain text, so you can dump the password? I mean, even if you don't have access to the desktop, you can just start msedge.exe with the URL for the site as an argument and trigger the password retrieval.

Edge has done a lot to improve credential security, even DPAPI's existence itself is huge. If your research has meat, that's great but I don't see it here.

This feels like some "researcher" hyping themselves up to me, but I could be wrong.

Also, I really despise how they posted this on twitter, not even considering the political landmine there, I can't see the comments or threads on there without logging in. I can't visit the site on mobile without being redirected to download the app. I just wanted to mention that if you use X as a security professional in this day and age, my opinion of you drops by like 50% immediately. I don't care if you use bluesky, vk, telegram, discord,facebook, threads or whatever else, twitter is the worst place for you to share your work and you should know better.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#122

Post by Hikikomori »

aslihana wrote: post #99

Correct me if I am wrong but chrome is-at least was- keeping passwords as raw text in Windows too. I got friend's forgotten password from Chrome on 2021 version

Chrome added app bound encryption of cookie files in 2024.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#123

Post by NewsaHackO »

maxloh wrote: post #115
gruez wrote: post #4

This feels like a case of "It rather involved being on the other side of this airtight hatchway"[1]. If you can read arbitrary process memory, you're probably also in a position to just dump out the passwords by pretending to be the user in question. > If an attacker gains administrative access on a terminal server, they can access the memory of all logged‑on user processes. If an attacker has administrative access,…

This logic is perfectly aligned with the Chromium threat model. Once an attacker gains administrator access, it is game over by definition. I doubt this is an Edge-specific issue. Microsoft has no interest in making their browser less secure than its upstream. > Why aren‘t physically-local attacks in Chrome’s threat model? > We consider these attacks outside Chrome's threat model, because there is no way for Chrome (…

Come on, they could still get a blood sample to really verify that its the user

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#125

Post by avereveard »

Lorkki wrote: post #88
gruez wrote: post #4

This feels like a case of "It rather involved being on the other side of this airtight hatchway"[1]. If you can read arbitrary process memory, you're probably also in a position to just dump out the passwords by pretending to be the user in question. > If an attacker gains administrative access on a terminal server, they can access the memory of all logged‑on user processes. If an attacker has administrative access,…

In recent years we've also had browser-exploitable vulnerabilities that allowed reading arbitrary memory as a regular user, but slowly or without full control over the locations. I think wiping credentials as soon as possible after use is a very sensible precaution, even if it's only a moat.

It's surprisingly hard to do the compiler or cpu may see a write without a read and optimize it away. Windows has a SecureZeroMemory and a few other barrier primitives but not all languages reach to it

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#126

Post by yellowapple »

maxloh wrote: post #115
gruez wrote: post #4

This feels like a case of "It rather involved being on the other side of this airtight hatchway"[1]. If you can read arbitrary process memory, you're probably also in a position to just dump out the passwords by pretending to be the user in question. > If an attacker gains administrative access on a terminal server, they can access the memory of all logged‑on user processes. If an attacker has administrative access,…

This logic is perfectly aligned with the Chromium threat model. Once an attacker gains administrator access, it is game over by definition. I doubt this is an Edge-specific issue. Microsoft has no interest in making their browser less secure than its upstream. > Why aren‘t physically-local attacks in Chrome’s threat model? > We consider these attacks outside Chrome's threat model, because there is no way for Chrome (…

> I doubt this is an Edge-specific issue.

It absolutely ain't Edge-specific. Firefox (AFAICT) also keeps stored passwords in clear-text unless encrypted with a passphrase (which is not the default on desktop; on Android there's a fingerprint/PIN check to access them, but I don't know offhand if there's any encryption involved with that).

Really this is true of most credentials stored within applications; unless you're providing a decryption key on open (whether explicitly or on OS-level login using some keychain mechanism), the stored credentials are probably plaintext.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#127

Post by formerly_proven »

maxloh wrote: post #115
gruez wrote: post #4

This feels like a case of "It rather involved being on the other side of this airtight hatchway"[1]. If you can read arbitrary process memory, you're probably also in a position to just dump out the passwords by pretending to be the user in question. > If an attacker gains administrative access on a terminal server, they can access the memory of all logged‑on user processes. If an attacker has administrative access,…

This logic is perfectly aligned with the Chromium threat model. Once an attacker gains administrator access, it is game over by definition. I doubt this is an Edge-specific issue. Microsoft has no interest in making their browser less secure than its upstream. > Why aren‘t physically-local attacks in Chrome’s threat model? > We consider these attacks outside Chrome's threat model, because there is no way for Chrome (…

It's a very standard defense-in-depth technique to put secrets between guard pages and only make the secret page readable when needed. That way any inadvertent access, be it programming error or exploit, simply causes a segfault, unless it's raced with a valid access (in a multithreaded or shm context) or the exploit explicitly changed the permission bits. Most memory disclosure vulnerabilities don't allow you to do that.

That being said any single password, when used, passes through so many layers and components that it's likely impossible to even just wipe the contaminated memory locations. But that's fine, the password database is opened for most of the browser's lifetime, any given password actively being used is a rare event in comparison.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#129

Post by golem14 »

Since it's not been clearly stated: One attack vector might be that I step out to the bathroom for 5 minutes without locking computer, and evil hacker just dumps all my passwords before I come back.

I think it's worthwhile considering this. There's a reason why password managers ask for a master password or passkey after 10 minutes. Since I thought Chrome relied on an encrypted enclave, it isn't quite feasible to extract passwords easily even with root access.

Yes, you shouldn't leave your computer unattended. But that doesn't mean designing products that make exploiting the inevitable slipup fatal.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#130

Post by angry_octet »

gruez wrote: post #4

This feels like a case of "It rather involved being on the other side of this airtight hatchway"[1]. If you can read arbitrary process memory, you're probably also in a position to just dump out the passwords by pretending to be the user in question. > If an attacker gains administrative access on a terminal server, they can access the memory of all logged‑on user processes. If an attacker has administrative access,…

This is a fallacious belief. While there is not point in obscurity, there is much value in not making it trivially easy to read passwords, as most exploits (especially of chromium) are not full user compromise, but the ability to massage some memory structures and read/write specific interesting bytes.

Additionally, the passwords could be kept encrypted in another process, and decrypted on demand, essentially a password vault. This lets you use techniques like biometric or physical button approval for password use, and reduces the likelihood of a browser memory dump containing passwords.

File audit capabilities in the OS can also be tuned so that only the vault application should be reading the vault file. Make info stealers job difficult.

Post reply on HN