Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chrome's insane password security strategy

blog.elliottkember.com

Post reply on HN
Print view View original

251–260 of 315 posts

Re: Chrome's insane password security strategy

#251

Post by bas »

nazbot wrote: post #230
justinschuh wrote: post #89

Earlier quoted context omitted.

I'm sorry, but I really do understand your argument. You're claiming that the same novice who can't install a simple application or or follow three steps to reveal a password on the page will be capable of drilling down through the Chrome settings menus and displaying passwords. The corollary to your claim is that the threat of this novice outweighs the damage of encouraging people to leave their computers unlocked i…

The value, I think, is in challenging your own beliefs. To be honest this reminds me a lot of how Microsoft used to treat issues in their code/software 'Oh, that's a user error. That's not a bug, that's a feature!'. And then when you get pushback you go 'I've discussed this enough, no more talking with the plebes'. Your axiom seems to be that anyone with access to your computer should be 'trusted'. In other words, if…

> It just seems like you don't get how people ACTUALLY use your product.

Exactly. Well said.

Re: Chrome's insane password security strategy

#252

Post by Gootch »

corobo wrote: post #186
jperrez wrote: post #174

Earlier quoted context omitted.

OK, it is my fault to leave my laptop unlocked and I'm putting myself at risk by using a browser that let anyone to see my stored passwords in plain-text in a single click...

Not sure if sarcasm.. Yes it is your fault if you forget to lock your account when you leave your machine unattended. It's also a click per password after the three clicks to get to that page.

I just had to go take a piss though.. like really bad... I couldn't think... and by the time I got back, all my passwords were stolen by my sister's idiot friend...

Wish my passwords were at least behind my Google Account username/password :/

Re: Chrome's insane password security strategy

#253

Post by anologwintermut »

kapowaz wrote: post #197
justinschuh wrote: post #77

I'm the Chrome browser security tech lead, so it might help if I explain our reasoning here. The only strong permission boundary for your password storage is the OS user account. So, Chrome uses whatever encrypted storage the system provides to keep your passwords safe for a locked account. Beyond that, however, we've found that boundaries within the OS user account just aren't reliable, and are mostly just theater.…

I wholeheartedly disagree with several of the points you make here, and I think you're more or less ‘passing the buck’ on something which is most definitely your responsibility to take good care with. On OS X, once you save a password using Safari, it is added to your login keychain. In order to then see that password* you must enter your login password again, be that via Safari's preferences dialog or the Keychain A…

True, chrome circumvents safari's password security by merely querying the keychain without prompting for a password. What stops anything(or anyone) else from doing it? Absolutely nothing.

You've fallen into exactly the trap they wanted to avoid. You assumed Safari's password security mechanism was more secure than it is. If chrome can access it without a password prompt, I can too. In fact, there's probably some nice apple script one liner to do it.

Re: Chrome's insane password security strategy

#254

Post by Gootch »

justinschuh wrote: post #77

I'm the Chrome browser security tech lead, so it might help if I explain our reasoning here. The only strong permission boundary for your password storage is the OS user account. So, Chrome uses whatever encrypted storage the system provides to keep your passwords safe for a locked account. Beyond that, however, we've found that boundaries within the OS user account just aren't reliable, and are mostly just theater.…

If you're not going to protect people by implementing a simple master password mechinism (Google Account, on by default if you are logged in), you should at least warn people that saving their passwords is risky.

The Chrome user interface doesn't let average users know their passwords are stored in such an easily accessible way. "Do you want to save your password?"... If they knew, it would 100% of the time be "Hell no!"... but Chrome asks by default, which puts millions of average users at risk... what a shame.

Re: Chrome's insane password security strategy

#255

Post by bryanbroussard9 »

elliottkember wrote: post #84
justinschuh wrote: post #83

Earlier quoted context omitted.

I appreciate how this appears to a novice, but we've literally spent years evaluating it and have quite a bit of data to inform our position. And while you're certainly well intentioned, what you're proposing is that that we make users less safe than they are today by providing them a false sense of security and encouraging dangerous behavior. That's just not how we approach security on Chrome.

Novice? I'm sorry, but whether I'm a novice has absolutely nothing to do with this. What I'm proposing is that you just don't show our passwords, all in one window, in plain text. I agree that this won't solve the problem, but would be a good first step. And I don't see how that would be dangerous. Alternatively, Chrome should make this more obvious so that users don't make assumptions about its security. How on eart…

Give a knowledgeable person physical access to a computer, and all of the clear text views in the browser do not matter. Just crack the user's password and you have access to any stored passwords. The password paradigm is not perfect. There is no perfect solution. Personally I like being able to check passwords easily, while being intelligent enough to put barriers in the path of the 'general snooper.'

Re: Chrome's insane password security strategy

#256

Post by old_man »

justinschuh wrote: post #77

I'm the Chrome browser security tech lead, so it might help if I explain our reasoning here. The only strong permission boundary for your password storage is the OS user account. So, Chrome uses whatever encrypted storage the system provides to keep your passwords safe for a locked account. Beyond that, however, we've found that boundaries within the OS user account just aren't reliable, and are mostly just theater.…

Your customers are asking you to put a lock on that safe. Yet you keep telling them to go lock the front door.

That's great, thanks for the reminder. I'll go use another safe that has extra security.

Re: Chrome's insane password security strategy

#257

Post by mullingitover »

papacity wrote: post #196
thisusername wrote: post #146

Earlier quoted context omitted.

Hahahahahhhh. Let me teach you a neat trick (I'll use firefox as an example, but this can be done in any browser because it's a "feature" of HTML). >Open firefox and navigate to a login page where your password is saved >Right click on password box and click inspect element >In the console, change type="password" to type="" >Move your eyes back to the password field Oh dear, what's this?! Protip: Don't store your pas…

Ha... The people complaining really are novices, looking for something to get outraged over. Every operating system allows multiple user accounts. I recommend people start learning how to use them.

I'm not a novice, but I would prefer that it wasn't trivial for a novice to access my passwords if I'm away from the keyboard for 30 seconds. A novice is going to have not a single clue of what to do with a console, but they can get at passwords in plaintext with four clicks with Chrome. No other browser makes it this easy to get at passwords in plaintext.

Re: Chrome's insane password security strategy

#259

Post by yacoob »

elliottkember wrote: post #81
justinschuh wrote: post #79

Earlier quoted context omitted.

Soft boundaries within the user account do nothing to protect you from exactly those scenarios either. Your protection is to lock your OS user account.

Hey Justin, I'm the author. I appreciate your sentiments, but I feel like they may be out of touch with the way real people are using computers in the wild. My suggestion is to seriously re-evaluate this approach in light of the actual use-case of how people perceive these passwords. It appears as though many, many users don't expect these passwords to be visible. This is an important thing to take into consideration…

It'd be worth nothing in your article that you can easily get that master password functionality under OSX - namely by locking the keychain.

http://support.apple.com/kb/PH10698

No idea how does it look like in other operating systems - especially under Linux which doesn't have THE keychain, it has keychains (ie. there's no common api to access a particular KDE/Gnome/etc implementation of it).

With keychain locked, Chrome asks for its password every time it needs to fetch a password - be it showing a list of them or pulling a password for particular site. It's done in a proper manner, and if you hand the keys to your house to that guy... well, you better trust them :)

Re: Chrome's insane password security strategy

#260

Post by taeric »

nazbot wrote: post #228
corobo wrote: post #199

Earlier quoted context omitted.

Changing the password is a fair point that I hadn't considered

Don't most sites require that you enter your old password before you can change it?

Not if you use the "reset" option. Which... you have their email account. So...
Post reply on HN