Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft Edge stores all passwords in memory in clear text, even when unused

twitter.com

Post reply on HN
Print view View original

151–160 of 243 posts

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#151

Post by oasisaimlessly »

ignoramous wrote: post #47
Someone1234 wrote: post #30

Earlier quoted context omitted.

Right; but in the scenario of this Tweek, you've invited someone untrustworthy into the vault and are then freaking out because they can see the post-it note of passwords. It is inherently irrational. This issue is inherently unfixable by ANY password manager, because the process model of the underlying OS isn't itself secure. No obfuscation will work, because the password manager itself needs to de-obfuscation it be…

> This issue is inherently unfixable by ANY password manager, because the process model of the underlying OS isn't itself secure Usually the confidential bits are hardware isolated away from the supervisor (host kernel/OS) in Enclaves/TEEs, Realms, Secure Elements, Security chips, etc.

No, that is actually very rare, not typical. Do you have any examples of password managers that do that?

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#152

Post by Dwedit »

dvt wrote: post #139
Dwedit wrote: post #109

Earlier quoted context omitted.

Guard pages are one-shot exceptions used for growing the stack.

They also act as access alarms[1]. Why even comment if you didn't bother to read the docs? > The PAGE_GUARD protection modifier establishes guard pages. Guard pages act as one-shot access alarms. For more information, see Creating Guard Pages. [1] https://learn.microsoft.com/en-us/windows/win32/api/memoryap...

Guard pages are for the process that creates them, they're not for the other processes that try to read the memory.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#153

Post by slurmz »

widelyusygas wrote: post #149
formerly_proven wrote: post #127

Earlier quoted context omitted.

It's a very standard defense-in-depth technique to put secrets between guard pages and only make the secret page readable when needed. That way any inadvertent access, be it programming error or exploit, simply causes a segfault, unless it's raced with a valid access (in a multithreaded or shm context) or the exploit explicitly changed the permission bits. Most memory disclosure vulnerabilities don't allow you to do…

> It's a very standard defense-in-depth technique Is there any software we’d be aware of which uses this technique

Windows and OpenSSL both do this

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#154

Post by Joker_vD »

slau wrote: post #85
alterom wrote: post #70

Earlier quoted context omitted.

>your hardware dies Or your backpack gets stolen. Oops. I swear, people who idolize passkey security must never travel anywhere. PS: "just have more devices with passkeys", they invariably say. Yeah right because people are made of money, everyone has the forethought, and a 2nd laptop in the US is a great asset when you're in Poland and can't login anywhere.

I travel a lot. By train, plane, and car. I also use passkeys when possible. I have multiple Yubikeys, stored in different locations. I also have a password manager, where I typically keep track of which logins aren’t yet backed up across physical tokens. It takes a bit of effort, but it’s not impossible. Yes, it means that in the event of catastrophic failure I might not be able to log in to some services until I ge…

> It takes a bit of effort

That's a wild understatement. For most users, having a password manager is already very near to the upper bound of acceptable friction.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#155

Post by traderj0e »

busterarm wrote: post #144
Someone1234 wrote: post #35

Earlier quoted context omitted.

Password hashes are one-directional lossy storage. If a password manager "hashed your password" it would be essentially deleting your password and replacing it with something else which cannot be used to log into anything. The password MUST be recoverable to plain-text to replay it to a website. But you're correct that Chrome, Firefox, Edge, Lastpass, BitWarden, even Keepass have the same issue. It is an Operating Sy…

I never said that they should be hashed, just that they aren't. Just subtly pointing out what the tradeoffs are if you choose to use a password manager whose storage/access is basically always available. At least with Keepass it's locked in an encrypted store and only available exactly when I need it to be. I can take other precautions if I want when I want to access it. With your browser's password manager you're st…

So are you typing your password every single time you want to unlock that store? If not, where's the master password stored? I know Keychain does something advanced with the enclave.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#156

Post by hypercube33 »

golem14 wrote: post #129

Since it's not been clearly stated: One attack vector might be that I step out to the bathroom for 5 minutes without locking computer, and evil hacker just dumps all my passwords before I come back. I think it's worthwhile considering this. There's a reason why password managers ask for a master password or passkey after 10 minutes. Since I thought Chrome relied on an encrypted enclave, it isn't quite feasible to ext…

Did they ever fix PCIe over thunderbolt security? seems like the security for it prompting to enable on plug vanished in 2019...it could read memory in some systems and that probably didn't matter if your machine was locked or not

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#157

Post by traderj0e »

IgorPartola wrote: post #142
giancarlostoro wrote: post #136

Earlier quoted context omitted.

I wonder about those kinds of exploits that sit on a webpage, but what stops someone from injecting their payload on a sites login page? JS can grab the password in plaintext in such a scenario, at which point the password manager does not save you. Can we normalize Passkey more?

I think the point is that you can have arbitrary website read the browser’s memory so example.com can read the password for example.org and example.net.

Or the computer's memory via Meltdown and Spectre-like attacks

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#158

Post by dboreham »

StilesCrisis wrote: post #77
alterom wrote: post #70

Earlier quoted context omitted.

>your hardware dies Or your backpack gets stolen. Oops. I swear, people who idolize passkey security must never travel anywhere. PS: "just have more devices with passkeys", they invariably say. Yeah right because people are made of money, everyone has the forethought, and a 2nd laptop in the US is a great asset when you're in Poland and can't login anywhere.

I've been avoiding passkeys but more and more websites are trying to push them, and one website I use now requires them. I've already got a password manager! I don't need to change everything again!

The good thing about this is they thereby also support FIDO2 hard tokens such as Yubikey. The UI is often confusing but you can always tell it to provision the key to your Yubikey rather than the OS enclave.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#159

Post by mjmas »

themaninthedark wrote: post #117
Someone1234 wrote: post #57

Earlier quoted context omitted.

True. But then your hardware dies, and you're locked out of every account you own. It is objectively good security, but has a ton of usability headaches yet to be really solved. I've seen orgs move to passkeys only, then offer reset-questions (e.g. city of first job, etc); because the Customer Service volume/workflow wasn't figured out.

At my work we required a complex password Updated to Windows Hello and passkey. Now I can use a 4 digit pin to login.

Yes, but the pin uses the TPM which allows other things like only ever allowing a low number of guesses before requiring a reset of the pin (using a password or other mechanism)

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#160

Post by busterarm »

traderj0e wrote: post #155
busterarm wrote: post #144

Earlier quoted context omitted.

I never said that they should be hashed, just that they aren't. Just subtly pointing out what the tradeoffs are if you choose to use a password manager whose storage/access is basically always available. At least with Keepass it's locked in an encrypted store and only available exactly when I need it to be. I can take other precautions if I want when I want to access it. With your browser's password manager you're st…

So are you typing your password every single time you want to unlock that store? If not, where's the master password stored? I know Keychain does something advanced with the enclave.

My master password is ~20 characters of strong randomness and completely in my head and has worked that way a good 10 years or so now.
Post reply on HN