Chrome's insane password security strategy • Hacker News Board

Re: Chrome's insane password security strategy

#261

Post by boyfriend » Wed, Aug 07, 2013, 6:10 PM UTC

justinschuh wrote: post #77

I'm the Chrome browser security tech lead, so it might help if I explain our reasoning here. The only strong permission boundary for your password storage is the OS user account. So, Chrome uses whatever encrypted storage the system provides to keep your passwords safe for a locked account. Beyond that, however, we've found that boundaries within the OS user account just aren't reliable, and are mostly just theater.…

This is so typical that the software designer looks at things only from the engineer perspective. Now I can see all the passwords my girlfriends saved in her chrome browser without me knowing any hacking knowledge. All I need is once in a while she didn't log out her browser account when she goes to restroom. God knows if any of those passwords is duplicate to the one she uses in online banking. You might argue that she doesn't log out the account exactly because she didn't know the threat of exposing her password by not logging out. But things like this happen, it just happen, everyday everywhere. Carelessness is in human nature. Now I get to know this issue because I check out Engadget from time to time. But I am sure my girlfriend doesn't. I am so sure that I can restrain my temptation of looking at her password when I love her. Hopefully we won't break up in the near future.

Re: Chrome's insane password security strategy

#262

Post by the_hangman » Wed, Aug 07, 2013, 6:12 PM UTC

dash2481 wrote: post #234

justinschuh wrote: post #86

Earlier quoted context omitted.

It matters that you don't seem to understand the threat model here. You think your passwords are protected somehow in other applications, but they're simply not. The fact is that they're still trivially recoverable, and if the bad guy can read them at all than he already has access to fully compromise your entire OS user account. So, you're arguing that we take measures to make users think they're safe when they've a…

Whoa, whoa, whoa. Let's all take a step back and try to see the forest for the trees. I read Mr. Kember's article (as well as numerous others linking to it around the web today) and what I read made me concerned enough to delete all of my passwords from Chrome until I understand a little more about the issue. justinschuh seems to have a deep technical understanding of programming and program security so I will defer…

You should probably direct your anger to the author of the article for exposing this to people like your druggie cousin who comes over for your birthday party if that's your main concern.

As long as your password keychain is unsecured, EVERY browser does this -- it's just a matter of knowing where the passwords are stored in the browser as plaintext. If you don't want people to access your accounts, then secure them. You can't have your cake and eat it too. Either your passwords are conveniently stored in plaintext so you can login easier, or you take actions to secure your account and add a step to the login process.

Re: Chrome's insane password security strategy

#263

Post by eirikir » Wed, Aug 07, 2013, 6:12 PM UTC

manicdee wrote: post #143

neilk wrote: post #109

Earlier quoted context omitted.

If I have access to your browser, I can get your credentials for Amazon by just going to Amazon.com . Either you already have a session open, and then I can do what I want (including changing your password), or the browser (or your password manager) is going to fill in the password automatically, and with a trivial knowledge of how the browser works I can copy the password. I use LastPass, and it is possible to set i…

My house has a front door which can be locked. I often leave it unlocked when I am out in the yard (and thus need access through the door on a minute-by-minute basis) or when I have guests over. I side my house I have safes, medicine cabinets and a gun rack. Those things are locked all the time, and I only unlock the cabinet when I need to use the items inside the secure container. So, too, I have a use account login…

Yes, thank you for explaining this so clearly. Of course I wouldn't knowingly give physical access of my computer to a malicious hacker, but if my friend asks to use it for 60 seconds while I take care of something else, I'd like to be able to do that without logging out and back in as a guest user. Convenience does matter in these kinds of situations, and deleting these "Show" buttons will make it more difficult for the untrained user to pull a prank or worse.

Re: Chrome's insane password security strategy

#264

Post by devero » Wed, Aug 07, 2013, 6:13 PM UTC

madaxe wrote: post #210

DanBC wrote: post #187

Earlier quoted context omitted.

> Why is it such a problem to ask the user to enter their account password before viewing this prefpane? You've not provided a valid argument against this. Most users do not have to enter their password when their OS boots, and thus won't know what it is. So offering it in Chrome is an inconvenience for most users, but adds no extra security. Once an attacker has physical access and can run Chrome browser it's game o…

Again, missing the point. Both your average attacker and average user have as much technical knowledge as a daffodil, which means even the most trivial barrier would be effective. As to users who don't set a password - never make the passwords visible.

what makes you think that people that hate to remember passwords will want to remember a password that locks them out of their password? This is stupid. Users that care about security will LEARN about more secure solutions one way or another. Don't treat humans as dumb fucks.

Re: Chrome's insane password security strategy

#265

Post by DripDrip » Wed, Aug 07, 2013, 6:18 PM UTC

elliottkember wrote: post #81

justinschuh wrote: post #79

Earlier quoted context omitted.

Soft boundaries within the user account do nothing to protect you from exactly those scenarios either. Your protection is to lock your OS user account.

Hey Justin, I'm the author. I appreciate your sentiments, but I feel like they may be out of touch with the way real people are using computers in the wild. My suggestion is to seriously re-evaluate this approach in light of the actual use-case of how people perceive these passwords. It appears as though many, many users don't expect these passwords to be visible. This is an important thing to take into consideration…

Does Justin have a Post-It stuck to his monitor labeled "Secret - Please Don't peek" with all of his passwords written on the back? Pretty tempting to anyone that may be somewhat ethically challenged. Yeah, I don't leave my wallet on my desk either.

Re: Chrome's insane password security strategy

#266

Post by pouetalex » Wed, Aug 07, 2013, 6:18 PM UTC

justinschuh wrote: post #77

I'm the Chrome browser security tech lead, so it might help if I explain our reasoning here. The only strong permission boundary for your password storage is the OS user account. So, Chrome uses whatever encrypted storage the system provides to keep your passwords safe for a locked account. Beyond that, however, we've found that boundaries within the OS user account just aren't reliable, and are mostly just theater.…

From my office workstation, in this list I can read password of my personal NAS that I only access from home.

Does it means that all these passwords are stored in my Google Account ?

Does it means that applying steps below is possible ?

1. Steal Google credentials : By using phishing or simply access the password Chrome page of an unmonitored screen (it only requires 10 seconds), 2. On a other system, use the stolen Google credentials to connect on an blank Chrome installation, 3. Open the password list page, and get access to all the passwords registered in the Google Account.

If it works, it provides a long term remote access to all the passwords stored on the targeted Google Account.

Even if the targeted user changes the stored passwords (Facebook, ...), as long as it stores them on Chrome and does not change its Google password, I can get all the password changes.

Please, tell me that I missed something, and that I am wrong ...

Re: Chrome's insane password security strategy

#267

Post by paulofthepark » Wed, Aug 07, 2013, 6:21 PM UTC

elliottkember wrote: post #81

justinschuh wrote: post #79

Earlier quoted context omitted.

Soft boundaries within the user account do nothing to protect you from exactly those scenarios either. Your protection is to lock your OS user account.

Hey Justin, I'm the author. I appreciate your sentiments, but I feel like they may be out of touch with the way real people are using computers in the wild. My suggestion is to seriously re-evaluate this approach in light of the actual use-case of how people perceive these passwords. It appears as though many, many users don't expect these passwords to be visible. This is an important thing to take into consideration…

Way too easy. My little brother screwed me over twice with this. This has been an issue for me every since switching from firefox to chrome. If you're going to offer a saved password option at least give me a master password option too. or at least give me a warning that this is a dumb idea.We're not all security experts. By not enabling a thin layer of falls security you just turned my grandmother into a computer hacker. And being the head of security at chrome I'd think you would be able to secure chrome at a browser level even if it is vulnerable in the OS. Unacceptable, but then again I'm just a novice.

Re: Chrome's insane password security strategy

#268

Post by shipofgold » Wed, Aug 07, 2013, 6:22 PM UTC

brown9-2 wrote: post #115

Throwadev wrote: post #92

Earlier quoted context omitted.

Elliottkmember is right here. Chrome's approach to this is absurd. What if you simply don't want friends, coworkers, significant others browsing your passwords? At least tell users that if they choose to save passwords in Chrome, that everyone who uses their computer, even pretty non-technical people, will be able to access those passwords. Tell them that storing their passwords in Chrome is unsafe. Justin, can you t…

Please don't invent motivations for the statements people make when you don't like what they've stated so far. If you don't want people browsing your passwords, you can't ever give them access to your user account or your unlocked desktop. That's it, that is the entire solution. Any other method of protecting the passwords is vulnerable as long as the potential attacker has physical access to the unlocked desktop. No…

What about the situation where I drop my computer off for service. While I may remember to delete all the passwords, I doubt my dad will...Now we have the possibility that a service tech who I will never meet can harvest credentials and sell them on the black market.

Re: Chrome's insane password security strategy

#269

Post by n00x » Wed, Aug 07, 2013, 6:54 PM UTC

elliottkember wrote: post #81

justinschuh wrote: post #79

Earlier quoted context omitted.

Soft boundaries within the user account do nothing to protect you from exactly those scenarios either. Your protection is to lock your OS user account.

Hey Justin, I'm the author. I appreciate your sentiments, but I feel like they may be out of touch with the way real people are using computers in the wild. My suggestion is to seriously re-evaluate this approach in light of the actual use-case of how people perceive these passwords. It appears as though many, many users don't expect these passwords to be visible. This is an important thing to take into consideration…

There is a saying in hindi - "Taala sharifon ke liye hota hai.". Loosely translated as "locks are for decent people". We put the locks for decent people not thieves. For a thief its nothing but an inconvinience. And we still put the locks, don't we?

Re: Chrome's insane password security strategy

#270

Post by aboodman » Wed, Aug 07, 2013, 7:10 PM UTC

nazbot wrote: post #233

aboodman wrote: post #157

Earlier quoted context omitted.

If you actually _want_ someone's password and you have access to their account, there are many things you can do, all equally easy. The more interesting argument here is the "crime of convenience" - where someone didn't want the passwords, but just saw them laying around in plain sight. But that isn't actually the case in Chrome: it's like four clicks. You have to actually be trying to find them.

The point is that 4 clicks is a LOT more convenient than most people would expect. Not to mention this doesn't seem to be an oversight by the Chrome team - it seems this is 'as designed'.

Isn't a more likely crime of convenience that you hand your friend your computer, he types "gmail.com" to login to his mail, but he automatically logs in to your gmail, and then he realizes he can do pretty much anything on your computer as you now (including changing all passwords linked to your gmail account)?

Why are you more concerned about something he has to go digging through settings purposely to find, than something he is almost guaranteed to stumble across?