Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Chrome security flaw offers unrestricted password access

theguardian.com

Post reply on HN
Print view View original

21–30 of 95 posts

Re: Google Chrome security flaw offers unrestricted password access

#21

Post by carlosrg »

tptacek wrote: post #10

This is embarrassing. What The Guardian (and, earlier, HN) is describing simply isn't a security flaw; rather, HN appears to have had a mild temper tantrum over the lack of a cosmetic "security" feature that, had Chrome implemented it, could have just as easily led to another temper tantrum over how easy it is to bypass.

It is a security flaw, and a big one. The only embarrassing thing here is Google's employees attempts at downplaying this.

And please explain how to bypass Safari password manager, or 1Password, or any password manager with a master password, if you believe it's only a cosmetic feature.

Re: Google Chrome security flaw offers unrestricted password access

#22

Post by interpol_p »

tptacek wrote: post #10

This is embarrassing. What The Guardian (and, earlier, HN) is describing simply isn't a security flaw; rather, HN appears to have had a mild temper tantrum over the lack of a cosmetic "security" feature that, had Chrome implemented it, could have just as easily led to another temper tantrum over how easy it is to bypass.

I am unsure why Chrome does not ask for the master password when the user attempts to reveal the plaintext for a password. Safari does this and it works.

This is a big deal because it makes reading passwords easy to do in seconds, and easy to do inconspicuously.

If you were to modify the DOM to unmask passwords it would take longer, and it's not something you can do while a co-worker or friend lends you their laptop for a minute. This flaw presents additional opportunity to anyone who wants to read another person's passwords.

It is not merely "cosmetic." It actually presents a real problem for anyone who does not logout of their account every time someone else uses their computer. Sure, this is probably best practice — but it is also insulting, inconvenient and an unrealistic expectation.

If I have unrestricted access to your machine, your passwords are compromised. Fine. But this is not a common or realistic scenario. It is far more likely I am using your machine with you, and then you walk out for 20 seconds to get a glass of water.

Re: Google Chrome security flaw offers unrestricted password access

#23

Post by interpol_p »

madsr wrote: post #7

Why is Chrome named as the "bad guy"? If anything, Chrome reveals the issue, by showing just how accessible browser-saved passwords are in the first place. Do you think that it's impossible for malware to retrieve passwords from IE, Firefox, Safari and Opera? Just how is it possible to import the passwords from these applications, then? This is not a security flaw. Comparing browser password storage to a safe is mild…

If Chrome wanted to be informative it would tell you clearly that your passwords are readable in plaintext at chrome://settings/passwords. It does not do this when it saves a password.

Either it tells you that your passwords are readable (and thus you are less likely to trust it) or it makes some attempt to prevent your passwords from being read within seconds. It can't have it both ways.

Re: Google Chrome security flaw offers unrestricted password access

#24

Post by Kurtz79 »

Given that:

- I understand the fact that the browser must be able to have the password in plaintext at the moment of logging to a website.

- I understand that if someone has access to my account on my computer then is able to access all the sensitive information that I have stored unencrypted on it, and not just my browser's passwords.

- I understand that is not something new or ground-breaking, or even something exclusively related to Chrome.

I still can't see how sensible having an option to show the passwords in plaintext, without protection, really is. Many people (non tech-savvy people in particular) for example do not lock their OS profile at all.

Requiring a Master Password by default (with the possibility of opting out in the settings) before using/showing passwords, and storing these in crypted form it would seem more sensible to me.

Re: Google Chrome security flaw offers unrestricted password access

#25

Post by interpol_p »

corobo wrote: post #17

People can also browse My Documents if they're logged in to my account. Microsoft should get this bug fixed asap.

Chrome should ask for the master Keychain password when you attempt to unmask a password. It does not do this, and it could easily do this (like Safari does). So it's a flaw.

Alternatively Chrome should inform the user that saved passwords are easily readable in plaintext, so that users will not trust it as much. It does not do this either.

There's a difference between browsing someone's private documents and having permanent access to their email account via their password.

Re: Google Chrome security flaw offers unrestricted password access

#28

Post by Hello71 »

interpol_p wrote: post #22
tptacek wrote: post #10

This is embarrassing. What The Guardian (and, earlier, HN) is describing simply isn't a security flaw; rather, HN appears to have had a mild temper tantrum over the lack of a cosmetic "security" feature that, had Chrome implemented it, could have just as easily led to another temper tantrum over how easy it is to bypass.

I am unsure why Chrome does not ask for the master password when the user attempts to reveal the plaintext for a password. Safari does this and it works. This is a big deal because it makes reading passwords easy to do in seconds, and easy to do inconspicuously. If you were to modify the DOM to unmask passwords it would take longer, and it's not something you can do while a co-worker or friend lends you their laptop…

    javascript:var a=document.querySelectorAll("input[type='password']");for(var i=a.length-1;i>=0;i--){a[i].type="text"}void 0

Re: Google Chrome security flaw offers unrestricted password access

#29

Post by interpol_p »

Hello71 wrote: post #28
interpol_p wrote: post #22

Earlier quoted context omitted.

I am unsure why Chrome does not ask for the master password when the user attempts to reveal the plaintext for a password. Safari does this and it works. This is a big deal because it makes reading passwords easy to do in seconds, and easy to do inconspicuously. If you were to modify the DOM to unmask passwords it would take longer, and it's not something you can do while a co-worker or friend lends you their laptop…

javascript:var a=document.querySelectorAll("input[type='password']");for(var i=a.length-1;i>=0;i--){a[i].type="text"}void 0

You will have to do that for each site you want passwords for, after they have been autofilled (whereas Chrome gives you a convenient list of all saved passwords). It is also a far more technical method than most people are comfortable with. Slower and more difficult, thus less likely to happen casually.

There is also a significant difference in feeling between the two methods. Your suggestion requires far more intent than visiting the settings page. This is important.

We are not talking about defending yourself from a malicious attacker, we are talking about the moments when you pass your computer to a friend so they can look something up. They can now look up your passwords conveniently and without feeling too bad about it.

Post reply on HN