Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft Edge stores all passwords in memory in clear text, even when unused

twitter.com

Post reply on HN
Print view View original

141–150 of 243 posts

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#141

Post by colechristensen »

gruez wrote: post #4

This feels like a case of "It rather involved being on the other side of this airtight hatchway"[1]. If you can read arbitrary process memory, you're probably also in a position to just dump out the passwords by pretending to be the user in question. > If an attacker gains administrative access on a terminal server, they can access the memory of all logged‑on user processes. If an attacker has administrative access,…

>If you can read arbitrary process memory, you're probably also in a position to just dump out the passwords by pretending to be the user in question.

This is the load bearing argument and it is false.

There are plenty of circumstances were you can grab a piece of process memory but not all of it.

There are plenty more circumstances where you can grab process memory but not kernel memory.

There are plenty more (almost all) where you can dump kernel and process memory but you can't access the keys stored in the TPM module.

Leaving the door open for anyone with the smallest exploit is stupid and bad security.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#142

Post by IgorPartola »

giancarlostoro wrote: post #136
Lorkki wrote: post #88

Earlier quoted context omitted.

In recent years we've also had browser-exploitable vulnerabilities that allowed reading arbitrary memory as a regular user, but slowly or without full control over the locations. I think wiping credentials as soon as possible after use is a very sensible precaution, even if it's only a moat.

I wonder about those kinds of exploits that sit on a webpage, but what stops someone from injecting their payload on a sites login page? JS can grab the password in plaintext in such a scenario, at which point the password manager does not save you. Can we normalize Passkey more?

I think the point is that you can have arbitrary website read the browser’s memory so example.com can read the password for example.org and example.net.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#144

Post by busterarm »

Someone1234 wrote: post #35
busterarm wrote: post #13

For anyone that thinks this is an Edge-specific dunk, Chrome does not hash your passwords and they are cleartext in memory while Chrome is running (which for most users is always).

Password hashes are one-directional lossy storage. If a password manager "hashed your password" it would be essentially deleting your password and replacing it with something else which cannot be used to log into anything. The password MUST be recoverable to plain-text to replay it to a website. But you're correct that Chrome, Firefox, Edge, Lastpass, BitWarden, even Keepass have the same issue. It is an Operating Sy…

I never said that they should be hashed, just that they aren't. Just subtly pointing out what the tradeoffs are if you choose to use a password manager whose storage/access is basically always available.

At least with Keepass it's locked in an encrypted store and only available exactly when I need it to be. I can take other precautions if I want when I want to access it.

With your browser's password manager you're stuck with the slop you were given.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#145

Post by Marsymars »

crazygringo wrote: post #119
stouset wrote: post #118

Earlier quoted context omitted.

Nobody is asking you to?

The subject here is literally websites trying to push passkeys on users. That is who is asking us to. About every week now Amazon tries to trick me into creating a passkey. It doesn't even ask, it just goes ahead and triggers my browser passkey creation mechanism without my consent. PayPal recently tried to force me to create one too and I had to kill and restart the app because that was the only way to skip it. I'll…

It's wildly obnoxious that browsers don't let you generally suppress these prompts.

And if you take the nuclear option and strip your browser of WebAuthn support, then you obviously can't use any passkeys, which doesn't work for me - I have two sites where I do want to use passkeys (because it's the only way to avoid SMS-based MFA on every login), but I never want to see passkey prompts for any other sites.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#146

Post by userbinator »

pibaker wrote: post #110
gruez wrote: post #4

This feels like a case of "It rather involved being on the other side of this airtight hatchway"[1]. If you can read arbitrary process memory, you're probably also in a position to just dump out the passwords by pretending to be the user in question. > If an attacker gains administrative access on a terminal server, they can access the memory of all logged‑on user processes. If an attacker has administrative access,…

Agreed. I keep seeing "high priority" "vulns" that require so much system access to actually exploit that they become pointless. If an untrusted process can read your memory or run as an administrator you have already lost. It honestly feels like more and more "security" people and businesses have less interest in actually securing systems and more in marketing themselves and their business hence the tendency to make…

Many of them also have vested interests in furthering corporate authoritarianism, which is why letting users have full control over their devices is considered a security risk to them.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#147

Post by LorenPechtel »

slow_typist wrote: post #89
cachius wrote: post #82

Earlier quoted context omitted.

The Swiss cheese model. Each single layer has holes, but when stacked the combined hole area is minimized https://en.wikipedia.org/wiki/Swiss_cheese_model

The Swiss cheese model is what people use to sell you more 'security' related software systems that inherently involve more problems. (Also cheese is not very durable, even the kind without holes.)

Swiss cheese applies to more than just security systems.

Hiking with two GPS-capable devices is Swiss cheese.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#149

Post by widelyusygas »

formerly_proven wrote: post #127
maxloh wrote: post #115

Earlier quoted context omitted.

This logic is perfectly aligned with the Chromium threat model. Once an attacker gains administrator access, it is game over by definition. I doubt this is an Edge-specific issue. Microsoft has no interest in making their browser less secure than its upstream. > Why aren‘t physically-local attacks in Chrome’s threat model? > We consider these attacks outside Chrome's threat model, because there is no way for Chrome (…

It's a very standard defense-in-depth technique to put secrets between guard pages and only make the secret page readable when needed. That way any inadvertent access, be it programming error or exploit, simply causes a segfault, unless it's raced with a valid access (in a multithreaded or shm context) or the exploit explicitly changed the permission bits. Most memory disclosure vulnerabilities don't allow you to do…

> It's a very standard defense-in-depth technique

Is there any software we’d be aware of which uses this technique

Post reply on HN