Microsoft Edge stores all passwords in memory in clear text, even when unused • Hacker News Board

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#241

Post by slow_typist » Fri, May 08, 2026, 9:21 PM UTC

LorenPechtel wrote: post #235

slow_typist wrote: post #170

Earlier quoted context omitted.

That is redundancy in my book. I don’t expect holes in my GNSS devices. And if you want to be sure, bring three, because two GNSS units with different readings are not very helpful.

I don't expect holes. But both devices are exposed--something could happen to one of them. And since I like going out in the middle of nowhere I assume I either have to get myself out, or if that's impossible summon help. I don't want a single point of failure on either of these.

Fair enough. A paper map and the ability to navigate offline would be a nice backup, too. Not that I wouldn’t use GPS in distress.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#242

Post by jurf » Mon, May 11, 2026, 10:28 AM UTC

hWuxH wrote: post #222

jurf wrote: post #181

Earlier quoted context omitted.

Yeah because Meltdown and Spectre [0] weren't a thing. [0] https://spectreattack.com/

If passwords are fetched remotely on-demand, you steal the account API key from memory. If they're encrypted, you steal the master password or decryption key. ... So what's your solution?

I think it’s more about layers of defense being always better than relying on a single point of failure.

IIRC those bugs could only steal data, not do remote execution. If you did not store even the encrypted passwords in memory, getting the password/key to them compromised would still keep you safe, or at least upgrade it to a timing attack.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#243

Post by themaninthedark » Tue, May 12, 2026, 5:24 PM UTC

mjmas wrote: post #159

themaninthedark wrote: post #117

Earlier quoted context omitted.

At my work we required a complex password Updated to Windows Hello and passkey. Now I can use a 4 digit pin to login.

Yes, but the pin uses the TPM which allows other things like only ever allowing a low number of guesses before requiring a reset of the pin (using a password or other mechanism)

Thanks, didn't know that!