Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft Edge stores all passwords in memory in clear text, even when unused

twitter.com

Post reply on HN
Print view View original

211–220 of 243 posts

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#211

Post by nightski »

Arainach wrote: post #205
nightski wrote: post #196

Earlier quoted context omitted.

Get a better password manager? Most store passkeys.

If the passkey can be stored in the password manager, then there's no second factor and what's the point?

Passkeys are password replacements that can't be breached/leaked/etc... I don't think they are necessarily supposed to replace 2-factor, however it's probably more secure than some of the weaker forms of 2-factor auth.

Given that in order to access your password manager's vault often requires 2-factor (or should at least) it's a level of security that I am comfortable with.

I take it a step further and host the password manager vault within my home network. My home network does not expose anything publicly except a WireGuard port, it's completely locked down. I have to VPN in to access the vault.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#212

Post by SAI_Peregrinus »

StilesCrisis wrote: post #79
jazzyjackson wrote: post #65

Earlier quoted context omitted.

especially when the point of a password manager is to stick a plaintext string into a webpage, which then transmits the plain text to a remote server. passwords are just not a very good solution to keeping secrets.

Never enter your password into a website that doesn't use https.

HTTPS encrypts the password in transit, but the remote server (verifier) still gets the plaintext of the password. You need a PAKE to use a password without transmitting it to the verifier.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#213

Post by netrap »

slow_typist wrote: post #92
gruez wrote: post #4

This feels like a case of "It rather involved being on the other side of this airtight hatchway"[1]. If you can read arbitrary process memory, you're probably also in a position to just dump out the passwords by pretending to be the user in question. > If an attacker gains administrative access on a terminal server, they can access the memory of all logged‑on user processes. If an attacker has administrative access,…

All true, but it is still bad style. There is no need to keep decrypted passwords in memory the user hasn’t even used in the session (or after they logged in to a certain website).

So you decrypt each time you need it? What is the difference in the attack surface?

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#214

Post by Barbing »

alterom wrote: post #180
Barbing wrote: post #106

Earlier quoted context omitted.

>"just have more devices with passkeys" Confirms that strategy then For people who only use passwords having an extra device can help too. Google does not necessarily permit a login with a backup code, so to me it seems ideal to grab a spare phone, log into important accounts, and store it with a trusted party/friend. It could be very difficult to login to an account like Gmail from overseas in the event of PC+phone[…

>It could be very difficult to login to an account like Gmail from overseas in the event of PC+phone[+hardware key] theft Literally happened to me in Poland, which is why I avoid passkeys like the plague. (The thief got caught months later. That didn't help me.) >Maybe no big deal if you can port your number to a new phone right away. T-Mobile won't mail a SIM card overseas, and I doubt others will either. There is n…

Oh my goodness, what are we supposed to do?!

Edit: and near 0 customer support too

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#215

Post by stouset »

crazygringo wrote: post #209
stouset wrote: post #167

Earlier quoted context omitted.

We have now gone from having to “redo everything” to being asked to switch to a passkey by a grand total of one website. I’ll be honest I’ve heard a lot of griping about passkeys but I have gone out of my way to switch over to them and have had precisely zero issues over the dozens of sites that I’ve bothered to make the switch on. Login flow is simpler and doesn’t rely on a browser extension guessing at login fields…

You claimed "Nobody is asking you to". Me giving an example of one major website (actually, I gave two) is all that is needed to disprove your claim. I could provide plenty more examples of major websites asking me to, but I don't need to. I could provide plenty of examples of people telling people to "redo everything" with passkeys, but your own comment is literally advocating the same thing... Please don't mischara…

> > Why should I redo everything?

> Nobody is asking you to?

Nobody is in fact asking you to change everything.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#216

Post by dlcarrier »

alterom wrote: post #182
dlcarrier wrote: post #97

Earlier quoted context omitted.

It is when the computer is off.

And if you whack someone with a wrench until they tell you the password, it's even easier! Seriously, if someone is getting physical access to the machine to the extent where they can remove the hard drive... I doubt that it makes a difference whether the browser's password manager keeps its passwords encrypted in-memory.

There's a huge difference in physical and criminal liability for stealing a laptop vs kidnapping someone. If tools become widespread for criminals to recover user accounts from an unpowered laptop, there's going to be an uptick in identity theft. When many cities would't even prosecute for the theft of a laptop, almost no one that's willing to steal a laptop is willing to hold someone up, which not only puts the criminal at physical risk of the victim attacking but also could result in decades of incarceration, if caught.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#217

Post by dlcarrier »

peterdemin wrote: post #150

Sorry for off topic, is the situation the same with Safari on MacOS? I have to touch-id every time I fill the password, so it seems like it’s not available in-memory.

Anything with biometric authentication has to store the password in a recoverable way. The fingerprint sensor isn't repeatable enough to use your fingerprint data to encrypt the password, so all it can do is compare your fingerprint data to stored data, and if it's vaguely similar, give an okay to use a copy of the password it stored.

That's on top of a host of reasons why biometric authentication isn't very good security, so if you care at all about your data, just use a password. If you're any good at typing, it's usually just as fast and convenient, anyway.

It's slower on a phone, but a randomly-generated four-digit PIN's one-in-ten-thousand security is still better than a fingerprint, and most phones do allow more digits.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#218

Post by stouset »

alterom wrote: post #174
stouset wrote: post #167

Earlier quoted context omitted.

We have now gone from having to “redo everything” to being asked to switch to a passkey by a grand total of one website. I’ll be honest I’ve heard a lot of griping about passkeys but I have gone out of my way to switch over to them and have had precisely zero issues over the dozens of sites that I’ve bothered to make the switch on. Login flow is simpler and doesn’t rely on a browser extension guessing at login fields…

>We have now gone from having to “redo everything” to being asked to switch to a passkey by a grand total of one website. Yeah right. When passkeys were rolled out, I was told it's OK because "passwords are always going to be required to be an available alternative". Now we've moved the goalposts to "it's just one website". >Sometimes the new thing really is just better. And sometimes your backpack is stolen when you…

What if I told you I was not one of the people saying that? You can’t take two different people with two different opinions and say “Look! You’ve moved the goalposts!”

If passkeys are significantly better, passwords will gradually stop existing. If passwords are, passkeys probably won’t catch on.

> And sometimes your backpack is stolen when you're traveling, with your phone and laptop (happened to me in Poland), and you need to log into your accounts while having none of your devices or your phone number available.

I personally keep a separate YubiKey that—along with a memorized password—is sufficient for me to retrieve my password manager database and unlock it. If this is a sufficiently motivating use-case for you, you too can take these kinds of steps to mitigate the risk.

But since we’re playing the “what if” game, what happens if you get early onset dementia and forget your passwords? Pray tell then what?

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#219

Post by munk-a »

kleiba2 wrote: post #185
ylk wrote: post #96

Earlier quoted context omitted.

There are (illegal) marketplaces initial access brokers sell session cookies on. Some companies try to defend against that by e.g. checking whether it's even possible that you travelled from place A to place B within a certain timeframe and, based on that, might invalidate your cookie. But then again attackers, depending on their sophistication, find their ways around it by ensuring they proxy their traffic via geogr…

Cookies can be up to 4kb in size - that should be enough to encode a fingerprint of your device.

The cookie should always be minimal and arbitrary. If you want to fingerprint the device and have confidence in that correctness it's something you should store on the server (or at least store a hash of on the server).

Anything that is on a client device can be manipulated without your awareness.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#220

Post by alterom »

stouset wrote: post #218
alterom wrote: post #174

Earlier quoted context omitted.

>We have now gone from having to “redo everything” to being asked to switch to a passkey by a grand total of one website. Yeah right. When passkeys were rolled out, I was told it's OK because "passwords are always going to be required to be an available alternative". Now we've moved the goalposts to "it's just one website". >Sometimes the new thing really is just better. And sometimes your backpack is stolen when you…

What if I told you I was not one of the people saying that? You can’t take two different people with two different opinions and say “Look! You’ve moved the goalposts!” If passkeys are significantly better, passwords will gradually stop existing. If passwords are, passkeys probably won’t catch on. > And sometimes your backpack is stolen when you're traveling, with your phone and laptop (happened to me in Poland), and…

>along with a memorized password—

So, your solution is passwords with extra steps.

Thanks but no thanks.

>I personally keep a separate YubiKey that—along with a memorized password—is sufficient for me to retrieve my password manager database and unlock it.

So, basically, having to create and maintain a backup device to keep separately from my laptop/phone in case they get stolen, make sure I don't lose it, but carry it with me everywhere like a crucifix.

That, and still having to remember and use a password, because otherwise the thieves get control of everything once they steal my device.

Sure. That's not objectively better than passwords which don't require this sort of hassle.

At the very least because it still requires a password.

>you too can take these kinds of steps to mitigate the risk.

OK. I can. I don't want to have to do these kind of steps, or any other dance to mitigate the real risks that passwords already protect me from.

Passkeys mitigate risks which I don't run into (”what if someone learns my password?”), while introducing others.

They are a convenience for people who run the system because they off-load those risks onto users.

>But since we’re playing the “what if” game

You're playing games with contrived hypotheticals.

I've had my laptop, phone, and wallet stolen on an overseas trip.

>what happens if you [...] forget your passwords?

I click the "forgot your password?" link which every website that uses passwords has.

Having a notebook in a vault with passwords also solves this problem.

I don't get a sudden onset of dementia which causes amnesia when I travel.

But I've lost my devices and had them stolen from me overseas.

It was a big enough hassle even though I did have the passwords.

Post reply on HN