Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft Edge stores all passwords in memory in clear text, even when unused

twitter.com

Post reply on HN
Print view View original

221–230 of 243 posts

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#221

Post by crazygringo »

stouset wrote: post #215
crazygringo wrote: post #209

Earlier quoted context omitted.

You claimed "Nobody is asking you to". Me giving an example of one major website (actually, I gave two) is all that is needed to disprove your claim. I could provide plenty more examples of major websites asking me to, but I don't need to. I could provide plenty of examples of people telling people to "redo everything" with passkeys, but your own comment is literally advocating the same thing... Please don't mischara…

> > Why should I redo everything? > Nobody is asking you to? Nobody is in fact asking you to change everything.

They literally are. You can easily google articles telling people to use passkeys for all their supported accounts. I'm not going to google it for you.

Why you are trying to claim the opposite is beyond me.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#222

Post by hWuxH »

jurf wrote: post #181
gruez wrote: post #4

This feels like a case of "It rather involved being on the other side of this airtight hatchway"[1]. If you can read arbitrary process memory, you're probably also in a position to just dump out the passwords by pretending to be the user in question. > If an attacker gains administrative access on a terminal server, they can access the memory of all logged‑on user processes. If an attacker has administrative access,…

Yeah because Meltdown and Spectre [0] weren't a thing. [0] https://spectreattack.com/

If passwords are fetched remotely on-demand, you steal the account API key from memory. If they're encrypted, you steal the master password or decryption key. ... So what's your solution?

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#223

Post by hWuxH »

wat10000 wrote: post #34
gruez wrote: post #4

This feels like a case of "It rather involved being on the other side of this airtight hatchway"[1]. If you can read arbitrary process memory, you're probably also in a position to just dump out the passwords by pretending to be the user in question. > If an attacker gains administrative access on a terminal server, they can access the memory of all logged‑on user processes. If an attacker has administrative access,…

There's little hope of protecting against a snooper seeing the passwords you actually use, since they have to exist in plaintext at some point. But there's no reason to expose the entire password database when no passwords are even being used .

What's the threat model where not storing them all at once provides any benefit? If someone has admin it's already game over. Can just hook the browser to retrieve all passwords on demand.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#224

Post by asmosoinio »

zx8080 wrote: post #107

The only important question is: does Chrome store passwords in the same way as Edge?

According to this article: No, they use DPAPI

https://security.googleblog.com/2024/07/improving-security-o...

> In Chrome 127 we are introducing a new protection on Windows that improves on the DPAPI by providing Application-Bound (App-Bound) Encryption primitives. Rather than allowing any app running as the logged in user to access this data, Chrome can now encrypt data tied to app identity, similar to how the Keychain operates on macOS.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#225

Post by asmosoinio »

busterarm wrote: post #13

For anyone that thinks this is an Edge-specific dunk, Chrome does not hash your passwords and they are cleartext in memory while Chrome is running (which for most users is always).

Not since 2024 according to this article? As they use DPAPI. Or am I reading this wrong?

https://security.googleblog.com/2024/07/improving-security-o...

> In Chrome 127 we are introducing a new protection on Windows that improves on the DPAPI by providing Application-Bound (App-Bound) Encryption primitives. Rather than allowing any app running as the logged in user to access this data, Chrome can now encrypt data tied to app identity, similar to how the Keychain operates on macOS.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#226

Post by Joker_vD »

slau wrote: post #204
alterom wrote: post #183

Earlier quoted context omitted.

>Yes, it means that in the event of catastrophic failure I might not be able to log in to some services until I get to one of the backups. I haven’t been able to imagine a scenario where that would be truly problematic. No need to imagine! Remove all passkeys from your phone and laptop, then go somewhere overseas without any of those Yubikeys. Have fun enjoy a "not truly problematic" scenario of getting your Yibikeys…

> Remove all passkeys from your phone and laptop I don't have any passkeys on my phone or laptop. They're all on the Yubikeys. I don't really see a difference with (some) password managers, though. If you use one of the keepasses, and you lose access to the file, you're in the same situation right? And yeah, you're right, there is a risk of inconvenience. I'm not debating that. I just choose to organise my life in su…

> and you lose access to the file,

It's literally at https://github.com/Joker-vD/keepassdb/raw/refs/heads/master/... in my case, plus a couple of other free hosting sites that support easy updates/reuploads, so losing access to it requires losing access to Internet — in which case you don't really need any (alright, most) of your passwords because you need Internet to connect to the services that require those passwords.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#227

Post by fragmede »

StilesCrisis wrote: post #108
stouset wrote: post #101

Earlier quoted context omitted.

Your password manager almost certainly already has baked-in passkey support.

It does, but what's your point? Why should I redo everything?

"redo" just press yes when the site offers and your password manager asks you to.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#228

Post by zbentley »

kenniskrag wrote: post #179
pjmlp wrote: post #175

As do almost every microservice out there, by storing credentials in environment variables, an exploit that manages to read container's memory is enough. I keep looking for frameworks that do it the right way, holding critical data encrypted all time, but it isn't a thing most people worry about.

What's the threat model. Where do you store the decryption key? E.g. if my app needs a db connection I can ask a vault service but I need creds for that. The vault service can rotate the creds very fast but is it addition security.

> What's the threat model

Malicious code can read some/all memory in your container, but not necessarily execute. Plenty of such vulns exist.

> Where do you store the decryption key?

Not in memory. Either nowhere after use, on the filesystem, or otherwise accessible on-demand by performing IO.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#230

Post by slau »

Joker_vD wrote: post #226
slau wrote: post #204

Earlier quoted context omitted.

> Remove all passkeys from your phone and laptop I don't have any passkeys on my phone or laptop. They're all on the Yubikeys. I don't really see a difference with (some) password managers, though. If you use one of the keepasses, and you lose access to the file, you're in the same situation right? And yeah, you're right, there is a risk of inconvenience. I'm not debating that. I just choose to organise my life in su…

> and you lose access to the file, It's literally at https://github.com/Joker-vD/keepassdb/raw/refs/heads/master/... in my case, plus a couple of other free hosting sites that support easy updates/reuploads, so losing access to it requires losing access to Internet — in which case you don't really need any (alright, most) of your passwords because you need Internet to connect to the services that require those passwo…

OK, fair, I never left my keepass file exposed like that when I used keepass.

If I remember correctly, 1Password still requires a "vault key" in addition to your username and password, and it was definitely too long and not used often enough for me to remember.

Post reply on HN