Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft Edge stores all passwords in memory in clear text, even when unused

twitter.com

Post reply on HN
Print view View original

171–180 of 243 posts

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#171

Post by kogepathic »

hypercube33 wrote: post #156
golem14 wrote: post #129

Since it's not been clearly stated: One attack vector might be that I step out to the bathroom for 5 minutes without locking computer, and evil hacker just dumps all my passwords before I come back. I think it's worthwhile considering this. There's a reason why password managers ask for a master password or passkey after 10 minutes. Since I thought Chrome relied on an encrypted enclave, it isn't quite feasible to ext…

Did they ever fix PCIe over thunderbolt security? seems like the security for it prompting to enable on plug vanished in 2019...it could read memory in some systems and that probably didn't matter if your machine was locked or not

> Did they ever fix PCIe over thunderbolt security?

It seems to depend on whether you're on a desktop or mobile device. [1]

> macOS 13 Ventura was released in 2022 and for portable Macs with Apple CPUs Apple introduced a feature known as ‘Accessory Security’ (also known as ‘Restricted Mode’)

> By default, portable Macs (i.e. laptops) with an Apple CPU running macOS 13 Ventura or newer version of macOS will require the end user to authenticate and approve a Thunderbolt device when initially connected.

> Stationary Macs (i.e. desktops) with an Apple CPU running macOS 13 Ventura or newer version of macOS do NOT implement the ‘Accessory Security’ feature. As a result, Thunderbolt devices will be automatically approved and authenticated when initially connected.

Anecdotally, I have had Dell and Lenovo laptops with Thunderbolt and in Linux I had to manually approve each new device before it would function. [2]

[1] https://kb.plugable.com/docking-stations-and-video/do-i-need...

[2] https://wiki.archlinux.org/title/Thunderbolt#User_device_aut...

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#172

Post by dvt »

Dwedit wrote: post #152
dvt wrote: post #139

Earlier quoted context omitted.

They also act as access alarms[1]. Why even comment if you didn't bother to read the docs? > The PAGE_GUARD protection modifier establishes guard pages. Guard pages act as one-shot access alarms. For more information, see Creating Guard Pages. [1] https://learn.microsoft.com/en-us/windows/win32/api/memoryap...

Guard pages are for the process that creates them, they're not for the other processes that try to read the memory.

Absolutely wrong. Are we writing the same code here? Page guards are for all userspace access. (In fact, I think kernel space might also trigger them, but can be circumvented. PS: I'm being polite :) Kernel space 100% triggers them, but can be cleverly circumvented by fucking with logs.)

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#173

Post by ivolimmen »

We have an automated task that runs the OWASP plugin (Maven on Java stack) that automatically creates a JIRA issue if there is any issue found. So I pickup the JIRA ticket and look at the CVE. First things first I __READ__ the actual CVE. Score: 7, ok that is bad Hacker can do ANYTHING by using the tmp file on THE ACTUAL MACHINE ... drag to cancel

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#174

Post by alterom »

stouset wrote: post #167
crazygringo wrote: post #119

Earlier quoted context omitted.

The subject here is literally websites trying to push passkeys on users. That is who is asking us to. About every week now Amazon tries to trick me into creating a passkey. It doesn't even ask, it just goes ahead and triggers my browser passkey creation mechanism without my consent. PayPal recently tried to force me to create one too and I had to kill and restart the app because that was the only way to skip it. I'll…

We have now gone from having to “redo everything” to being asked to switch to a passkey by a grand total of one website. I’ll be honest I’ve heard a lot of griping about passkeys but I have gone out of my way to switch over to them and have had precisely zero issues over the dozens of sites that I’ve bothered to make the switch on. Login flow is simpler and doesn’t rely on a browser extension guessing at login fields…

>We have now gone from having to “redo everything” to being asked to switch to a passkey by a grand total of one website.

Yeah right.

When passkeys were rolled out, I was told it's OK because "passwords are always going to be required to be an available alternative".

Now we've moved the goalposts to "it's just one website".

>Sometimes the new thing really is just better.

And sometimes your backpack is stolen when you're traveling, with your phone and laptop (happened to me in Poland), and you need to log into your accounts while having none of your devices or your phone number available.

Pray tell then what.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#175

Post by pjmlp »

As do almost every microservice out there, by storing credentials in environment variables, an exploit that manages to read container's memory is enough.

I keep looking for frameworks that do it the right way, holding critical data encrypted all time, but it isn't a thing most people worry about.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#176

Post by kenniskrag »

Someone1234 wrote: post #57
jazzyjackson wrote: post #51

Earlier quoted context omitted.

One more reason to use hardware-bound passkeys and not passwords.

True. But then your hardware dies, and you're locked out of every account you own. It is objectively good security, but has a ton of usability headaches yet to be really solved. I've seen orgs move to passkeys only, then offer reset-questions (e.g. city of first job, etc); because the Customer Service volume/workflow wasn't figured out.

> But then your hardware dies

A lot of services have password reset email features. If the email account has passkey you're screwed. But restore by snail mail can be possible but slow (for paid services). More secure? Don't know but same category of problems already known due to sim swapping attacks in mobile sector. But for sure the Mail account is a high value target.

Storing passkeys in a database may be possible but complex to do it right e.g. backup verification, avoiding to leak while backup etc.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#177

Post by kenniskrag »

kenniskrag wrote: post #176
Someone1234 wrote: post #57

Earlier quoted context omitted.

True. But then your hardware dies, and you're locked out of every account you own. It is objectively good security, but has a ton of usability headaches yet to be really solved. I've seen orgs move to passkeys only, then offer reset-questions (e.g. city of first job, etc); because the Customer Service volume/workflow wasn't figured out.

> But then your hardware dies A lot of services have password reset email features. If the email account has passkey you're screwed. But restore by snail mail can be possible but slow (for paid services). More secure? Don't know but same category of problems already known due to sim swapping attacks in mobile sector. But for sure the Mail account is a high value target. Storing passkeys in a database may be possible…

Edit:

Banking has no selfservice password reset. A lot of work for customer support due to identification. Nobody wants to do that for free and if the accounts are freenyou may get DOSed by bots which trigger passwort resets.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#178

Post by bartvk »

stouset wrote: post #118
StilesCrisis wrote: post #108

Earlier quoted context omitted.

It does, but what's your point? Why should I redo everything?

Nobody is asking you to?

Of course they are. Lots of websites are pushing it, including while using dark patterns. You need to sometimes explicitly cancel an onboarding flow to avoid Passkeys.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#179

Post by kenniskrag »

pjmlp wrote: post #175

As do almost every microservice out there, by storing credentials in environment variables, an exploit that manages to read container's memory is enough. I keep looking for frameworks that do it the right way, holding critical data encrypted all time, but it isn't a thing most people worry about.

What's the threat model. Where do you store the decryption key?

E.g. if my app needs a db connection I can ask a vault service but I need creds for that. The vault service can rotate the creds very fast but is it addition security.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#180

Post by alterom »

Barbing wrote: post #106
alterom wrote: post #70

Earlier quoted context omitted.

>your hardware dies Or your backpack gets stolen. Oops. I swear, people who idolize passkey security must never travel anywhere. PS: "just have more devices with passkeys", they invariably say. Yeah right because people are made of money, everyone has the forethought, and a 2nd laptop in the US is a great asset when you're in Poland and can't login anywhere.

>"just have more devices with passkeys" Confirms that strategy then For people who only use passwords having an extra device can help too. Google does not necessarily permit a login with a backup code, so to me it seems ideal to grab a spare phone, log into important accounts, and store it with a trusted party/friend. It could be very difficult to login to an account like Gmail from overseas in the event of PC+phone[…

>It could be very difficult to login to an account like Gmail from overseas in the event of PC+phone[+hardware key] theft

Literally happened to me in Poland, which is why I avoid passkeys like the plague.

(The thief got caught months later. That didn't help me.)

>Maybe no big deal if you can port your number to a new phone right away.

T-Mobile won't mail a SIM card overseas, and I doubt others will either. There is no "maybe", it's a certainty that you won't be able to.

>Or maybe the trusted friend can help

Yeah, my wife literally mailed me SIM card to Poland.

It took over week.

And a "trusted friend" would first have had to get it somehow.

>Or maybe the trusted friend can help (unless Google still finds the login suspicious after all, no idea there)

At least I logged into my accounts from that city before the laptop and phone were stolen, so my logins were not "suspicious".

That's with a password.

_____

PS: screw Citibank's mandatory phone -based "2FA".

Post reply on HN