Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft Edge stores all passwords in memory in clear text, even when unused

twitter.com

Post reply on HN
Print view View original

161–170 of 243 posts

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#161

Post by Arainach »

dboreham wrote: post #158
StilesCrisis wrote: post #77

Earlier quoted context omitted.

I've been avoiding passkeys but more and more websites are trying to push them, and one website I use now requires them. I've already got a password manager! I don't need to change everything again!

The good thing about this is they thereby also support FIDO2 hard tokens such as Yubikey. The UI is often confusing but you can always tell it to provision the key to your Yubikey rather than the OS enclave.

That doesn't help if my machine (with only a few USB ports) gets stolen/lost with the token in it. It doesn't help if some of my devices only have USB-C and some only have USB-A. It's absolutely more annoying than letting my password manager fill things in or typing in a 6 digit code from my authenticator app.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#162

Post by dev1ycan »

fsflover wrote: post #74

I don't understand, who are all these people who care about security and at the same time are using Microsoft Edge. Could someone enlighten me? Does it have some specific features that somebody needs?

They have what I think is the best implementation of vertical tabs, chrome doesn't even have them, firefox is so far behind it's not even funny anymore... brave's is terrible.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#163

Post by sandworm101 »

maxloh wrote: post #115
gruez wrote: post #4

This feels like a case of "It rather involved being on the other side of this airtight hatchway"[1]. If you can read arbitrary process memory, you're probably also in a position to just dump out the passwords by pretending to be the user in question. > If an attacker gains administrative access on a terminal server, they can access the memory of all logged‑on user processes. If an attacker has administrative access,…

This logic is perfectly aligned with the Chromium threat model. Once an attacker gains administrator access, it is game over by definition. I doubt this is an Edge-specific issue. Microsoft has no interest in making their browser less secure than its upstream. > Why aren‘t physically-local attacks in Chrome’s threat model? > We consider these attacks outside Chrome's threat model, because there is no way for Chrome (…

>> Microsoft has no interest in making their browser less secure than its upstream.

Microsoft has every interest in spending as little money as possible on edge, just enough to keep people swalling the tripe. User privacy is not a thing at MS and hasnt been for decades. Plaintext passwords in a MS product is just another monday. It will take decades more to convince me they have changed.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#164

Post by itemize123 »

Someone1234 wrote: post #94
dvt wrote: post #59

Earlier quoted context omitted.

This comment feels like it's written by AI. Anyway, PAGE_GUARD helps you get around VirtualProtectEx, which is a very common way of detecting userspace cheats.

> This comment feels like it's written by AI. Why exactly? I'm genuinely asking, because I feel like I get this a lot , and it is pretty frustrating.

basically very verbose and detailed but also very indirect. didn't get to the point till the end.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#166

Post by stackghost »

sandworm101 wrote: post #163
maxloh wrote: post #115

Earlier quoted context omitted.

This logic is perfectly aligned with the Chromium threat model. Once an attacker gains administrator access, it is game over by definition. I doubt this is an Edge-specific issue. Microsoft has no interest in making their browser less secure than its upstream. > Why aren‘t physically-local attacks in Chrome’s threat model? > We consider these attacks outside Chrome's threat model, because there is no way for Chrome (…

>> Microsoft has no interest in making their browser less secure than its upstream. Microsoft has every interest in spending as little money as possible on edge, just enough to keep people swalling the tripe. User privacy is not a thing at MS and hasnt been for decades. Plaintext passwords in a MS product is just another monday. It will take decades more to convince me they have changed.

Look, Ihate Microsoft too but Edge is just Chrome with a different skin, so they'd have to have gone out of their way (and spent money paying engineers) to make Edge less secure than Chrome/ium.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#167

Post by stouset »

crazygringo wrote: post #119
stouset wrote: post #118

Earlier quoted context omitted.

Nobody is asking you to?

The subject here is literally websites trying to push passkeys on users. That is who is asking us to. About every week now Amazon tries to trick me into creating a passkey. It doesn't even ask, it just goes ahead and triggers my browser passkey creation mechanism without my consent. PayPal recently tried to force me to create one too and I had to kill and restart the app because that was the only way to skip it. I'll…

We have now gone from having to “redo everything” to being asked to switch to a passkey by a grand total of one website.

I’ll be honest I’ve heard a lot of griping about passkeys but I have gone out of my way to switch over to them and have had precisely zero issues over the dozens of sites that I’ve bothered to make the switch on. Login flow is simpler and doesn’t rely on a browser extension guessing at login fields or trying to figure out when passwords change.

Sometimes the new thing really is just better.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#168

Post by jborean93 »

dist-epoch wrote: post #87
bobbiechen wrote: post #25

Earlier quoted context omitted.

This is generally true of every application that handles sensitive data. Unless you explicitly clear that memory, it's likely to hang around forever. For example, here is a 2019 writeup from KeePassXC with similar notes: https://keepassxc.org/blog/2019-02-21-memory-security/ - even though they explicitly clear sensitive data, there is still a window of opportunity. During my time working on confidential computing, we…

Windows already has a secure kernel credential store, they could move the Edge password store there with a bit of effort, minimize the splash damage when you retrieve a single password to send over HTTP from the regular user space. > Credential Guard prevents credential theft attacks by protecting NTLM password hashes, Kerberos Ticket Granting Tickets (TGTs), and credentials stored by applications as domain credentia…

This only works if credential guard has implemented a way to build a subsequent token/value from that secret. For things like basic auth the secret would need to eventually hit the userland process that needs it in some shape or form to then embed it in the HTTP payload which is plaintext.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#170

Post by slow_typist »

LorenPechtel wrote: post #147
slow_typist wrote: post #89

Earlier quoted context omitted.

The Swiss cheese model is what people use to sell you more 'security' related software systems that inherently involve more problems. (Also cheese is not very durable, even the kind without holes.)

Swiss cheese applies to more than just security systems. Hiking with two GPS-capable devices is Swiss cheese.

That is redundancy in my book. I don’t expect holes in my GNSS devices. And if you want to be sure, bring three, because two GNSS units with different readings are not very helpful.
Post reply on HN