Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft Edge stores all passwords in memory in clear text, even when unused

twitter.com

Post reply on HN
Print view View original

21–30 of 243 posts

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#21

Post by WolfeReader »

sedatk wrote: post #11
WolfeReader wrote: post #9

Please use a dedicated password manager, instead of a browser-based one. KeePass is likely the best going forward.

@taviso had claimed the exact opposite: https://lock.cmpxchg8b.com/passmgrs.html EDIT: Yes, he claimed that for online password managers, not keepass. I thought the argument was about password managers in general.

Browser-based password management serves the purpose of locking users into a specific browser; I'd much rather have the freedom to switch browsers at will without the cognitive tax of securely moving all my creds every time I want to switch my main browser.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#22

Post by stouset »

turtlebits wrote: post #12
gruez wrote: post #4

This feels like a case of "It rather involved being on the other side of this airtight hatchway"[1]. If you can read arbitrary process memory, you're probably also in a position to just dump out the passwords by pretending to be the user in question. > If an attacker gains administrative access on a terminal server, they can access the memory of all logged‑on user processes. If an attacker has administrative access,…

Security isn't black and white. If i leave a post-it note of my logins on my monitor, that's definitely less safe than in a unlocked drawer, and so on.

If I leave a post-it note of passwords on my monitor inside a vault to which only I have access, it’s not a big deal. That’s the point of the “airtight hatch” metaphor.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#23

Post by sedatk »

busterarm wrote: post #19
sedatk wrote: post #11

Earlier quoted context omitted.

@taviso had claimed the exact opposite: https://lock.cmpxchg8b.com/passmgrs.html EDIT: Yes, he claimed that for online password managers, not keepass. I thought the argument was about password managers in general.

That's not what that is saying. It's saying don't use an _online_ password manager instead of the browser one. In the very opening they state that simple implementations are great and even lists some. Then the rest of the article dives specifically into online password managers, which are something else.

You're right. Edited my comment.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#24

Post by WolfeReader »

Someone1234 wrote: post #16
WolfeReader wrote: post #9

Please use a dedicated password manager, instead of a browser-based one. KeePass is likely the best going forward.

If it is a process, running in the same user context, with the ability to read/dump arbitrary memory -- As the KeePass database is decrypted it would "store all passwords in memory in plain text" too. The fix isn't Edge Vs. Chrome. Vs KeePass Vs. Bitwarden, it is "How do I have my passwords exist in a different execution context than [evil process able to read all memory]?" Android and iOS have an "answer" to this pr…

This makes me miss running Qubes a few years ago, and keeping BitWarden in a separate VM from everything else. I've never felt as secure as when I had that setup.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#25

Post by bobbiechen »

busterarm wrote: post #13

For anyone that thinks this is an Edge-specific dunk, Chrome does not hash your passwords and they are cleartext in memory while Chrome is running (which for most users is always).

This is generally true of every application that handles sensitive data. Unless you explicitly clear that memory, it's likely to hang around forever.

For example, here is a 2019 writeup from KeePassXC with similar notes: https://keepassxc.org/blog/2019-02-21-memory-security/ - even though they explicitly clear sensitive data, there is still a window of opportunity.

During my time working on confidential computing, we had a variety of demos showing similar attacks against lots of different datastores, scripts, etc. That's just how computers work and your options are very limited if this is part of your threat model (imo just confidential computing and, if you can handle the performance hit, fully-homomorphic encryption).

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#27

Post by dcanelhas »

75central wrote: post #10
WolfeReader wrote: post #9

Please use a dedicated password manager, instead of a browser-based one. KeePass is likely the best going forward.

Out of curiosity, why KeePass versus Bitwarden? I've been using Bitwarden for years, but if there's a specific reason I should be using KeePass instead, I'm open to changing.

KeePass is just an encrypted database file with UI around it for usability. You can keep the db on a USB drive, sync it through a cloud storage, e-mail it to yourself, whatever ... It's really not that complicated. BitWarden is the above as a service, I reckon.

Nb. The above refers to KeePassX. No idea what the KeePass without the x is about. Naming things. So hard.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#28

Post by dvt »

gruez wrote: post #4

This feels like a case of "It rather involved being on the other side of this airtight hatchway"[1]. If you can read arbitrary process memory, you're probably also in a position to just dump out the passwords by pretending to be the user in question. > If an attacker gains administrative access on a terminal server, they can access the memory of all logged‑on user processes. If an attacker has administrative access,…

This is 100% that case. Basically every form (like this very one I'm typing in) is held in userspace memory un-encrypted. And yet lawyers and doctors and CIA operatives all use forms to type very sensitive stuff in.

It would be stupid, wasteful, and overly-complex to encrypt forms just in case some malicious process somehow got ring0 access. In that case, a keylogger is likely more useful anyway. And you're fucked even if you are encrypting stuff (as keys are likely also somewhere in memory[1] and they need to be—gasp—unencrypted). There's no free lunch.

Stupid Twitter thread meant to rage-bait for engagement.

[1] They could also be on disk or on some peripheral, but still fully readable by a motivated-enough hacker.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#29

Post by washingupliquid »

thumbsup-_- wrote: post #20

Its Microsoft doing Microsoft things

Linux stores plenty of passwords in clear text in /etc and $HOME and this is considered acceptable by most users. These same people also believe the TPM is a spy chip.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#30

Post by Someone1234 »

stouset wrote: post #22
turtlebits wrote: post #12

Earlier quoted context omitted.

Security isn't black and white. If i leave a post-it note of my logins on my monitor, that's definitely less safe than in a unlocked drawer, and so on.

If I leave a post-it note of passwords on my monitor inside a vault to which only I have access, it’s not a big deal. That’s the point of the “airtight hatch” metaphor.

Right; but in the scenario of this Tweek, you've invited someone untrustworthy into the vault and are then freaking out because they can see the post-it note of passwords. It is inherently irrational.

This issue is inherently unfixable by ANY password manager, because the process model of the underlying OS isn't itself secure. No obfuscation will work, because the password manager itself needs to de-obfuscation it before use (and that memory too is dump-able).

All adding in-memory obfuscation does it make ignorant people feel better, while not moving the security needle even an inch.

Post reply on HN