To be fair, 'loads into memory' and 'stores' are not the same thing.
Tbf the point of the post is the "even when unused" part. A memory store is still a store.
Microsoft Edge stores all passwords in memory in clear text, even when unused
191–200 of 243 posts
Re: Microsoft Edge stores all passwords in memory in clear text, even when unused
#192Earlier quoted context omitted.
If it is a process, running in the same user context, with the ability to read/dump arbitrary memory -- As the KeePass database is decrypted it would "store all passwords in memory in plain text" too. The fix isn't Edge Vs. Chrome. Vs KeePass Vs. Bitwarden, it is "How do I have my passwords exist in a different execution context than [evil process able to read all memory]?" Android and iOS have an "answer" to this pr…
This makes me miss running Qubes a few years ago, and keeping BitWarden in a separate VM from everything else. I've never felt as secure as when I had that setup.
Why did you stop?
Re: Microsoft Edge stores all passwords in memory in clear text, even when unused
#193[dead]
Re: Microsoft Edge stores all passwords in memory in clear text, even when unused
#194Earlier quoted context omitted.
In recent years we've also had browser-exploitable vulnerabilities that allowed reading arbitrary memory as a regular user, but slowly or without full control over the locations. I think wiping credentials as soon as possible after use is a very sensible precaution, even if it's only a moat.
I wonder about those kinds of exploits that sit on a webpage, but what stops someone from injecting their payload on a sites login page? JS can grab the password in plaintext in such a scenario, at which point the password manager does not save you. Can we normalize Passkey more?
That's why I disable JS by default with UBlock Origin. And OFC never allow JS to acces your clipbaord.
Re: Microsoft Edge stores all passwords in memory in clear text, even when unused
#195For reference, this is how Google says Chrome stores passwords encrypted in memory and uses an elevated service to prevent other processes from impersonating Chrome and gaining access to the plain text passwords: https://security.googleblog.com/2024/07/improving-security-o...
I recall chrome used to let you reveal passwords with a simple button press in the UI. I think their conclusion at the time was if an attacker had local access there was no point in pretending they were hidden.
I still found it insane to display passwords that easily. Sometimes I give brief access to my PC to friends, family, acquaintances, or even colleagues, and they shouldn't be able to see my passwords with a simple button. It's like leaving your bike out unlocked, because someone with the right tools can break the locks anyway.
Re: Microsoft Edge stores all passwords in memory in clear text, even when unused
#196Earlier quoted context omitted.
The good thing about this is they thereby also support FIDO2 hard tokens such as Yubikey. The UI is often confusing but you can always tell it to provision the key to your Yubikey rather than the OS enclave.
That doesn't help if my machine (with only a few USB ports) gets stolen/lost with the token in it. It doesn't help if some of my devices only have USB-C and some only have USB-A. It's absolutely more annoying than letting my password manager fill things in or typing in a 6 digit code from my authenticator app.
Get a better password manager? Most store passkeys.
Re: Microsoft Edge stores all passwords in memory in clear text, even when unused
#197Earlier quoted context omitted.
I recall chrome used to let you reveal passwords with a simple button press in the UI. I think their conclusion at the time was if an attacker had local access there was no point in pretending they were hidden.
I still found it insane to display passwords that easily. Sometimes I give brief access to my PC to friends, family, acquaintances, or even colleagues, and they shouldn't be able to see my passwords with a simple button. It's like leaving your bike out unlocked, because someone with the right tools can break the locks anyway.
I think it makes perfect sense. I want to see my passwords without having to re-enter my system password every time.
Operating systems have had guest accounts for decades for the "handing your PC to friends/family/etc." use case. Even Android phones have temporary guest accounts (though many manufacturers disable that because it interferes with their own secondary user-based hacks).
Re: Microsoft Edge stores all passwords in memory in clear text, even when unused
#198That's interesting, then that UAC prompt asking to enter login credentials to view existing saved password is useless.
Re: Microsoft Edge stores all passwords in memory in clear text, even when unused
#199Earlier quoted context omitted.
>> Microsoft has no interest in making their browser less secure than its upstream. Microsoft has every interest in spending as little money as possible on edge, just enough to keep people swalling the tripe. User privacy is not a thing at MS and hasnt been for decades. Plaintext passwords in a MS product is just another monday. It will take decades more to convince me they have changed.
Look, Ihate Microsoft too but Edge is just Chrome with a different skin, so they'd have to have gone out of their way (and spent money paying engineers) to make Edge less secure than Chrome/ium.
The whole point of them using chromium shows how little they care.
The old edge wasn't used much no but that wasn't due to its engine. Most people don't even know what a browser engine is.
They just didn't want to bother making a browser. But they want to benefit from the marketing advantages of having a browser so now they just lift along with chrome.
Re: Microsoft Edge stores all passwords in memory in clear text, even when unused
#200Earlier quoted context omitted.
I still found it insane to display passwords that easily. Sometimes I give brief access to my PC to friends, family, acquaintances, or even colleagues, and they shouldn't be able to see my passwords with a simple button. It's like leaving your bike out unlocked, because someone with the right tools can break the locks anyway.
I think it makes perfect sense. I want to see my passwords without having to re-enter my system password every time. Operating systems have had guest accounts for decades for the "handing your PC to friends/family/etc." use case. Even Android phones have temporary guest accounts (though many manufacturers disable that because it interferes with their own secondary user-based hacks).
Guest accounts are a nice theory that do not match the lived practice of scenarios such as "Yeah sure, go to the PC to add some songs to the playlist".