Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft Edge stores all passwords in memory in clear text, even when unused

twitter.com

Post reply on HN
Print view View original

31–40 of 243 posts

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#31

Post by Dwedit »

gruez wrote: post #4

This feels like a case of "It rather involved being on the other side of this airtight hatchway"[1]. If you can read arbitrary process memory, you're probably also in a position to just dump out the passwords by pretending to be the user in question. > If an attacker gains administrative access on a terminal server, they can access the memory of all logged‑on user processes. If an attacker has administrative access,…

Reading arbitrary process memory can be done as a standard user. No admin needed. Any Win32 program can do it. You just can't access the memory from processes that are admin-level.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#32

Post by sedatk »

WolfeReader wrote: post #21
sedatk wrote: post #11

Earlier quoted context omitted.

@taviso had claimed the exact opposite: https://lock.cmpxchg8b.com/passmgrs.html EDIT: Yes, he claimed that for online password managers, not keepass. I thought the argument was about password managers in general.

Browser-based password management serves the purpose of locking users into a specific browser; I'd much rather have the freedom to switch browsers at will without the cognitive tax of securely moving all my creds every time I want to switch my main browser.

I agree. It's especially problematic when you use different browsers on different devices and operating systems.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#33

Post by cwillu »

washingupliquid wrote: post #29
thumbsup-_- wrote: post #20

Its Microsoft doing Microsoft things

Linux stores plenty of passwords in clear text in /etc and $HOME and this is considered acceptable by most users. These same people also believe the TPM is a spy chip.

> Linux stores plenty of passwords in plain text in /etc

That's gonna be a big ol' [CITATION NEEDED] from me, dawg.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#34

Post by wat10000 »

gruez wrote: post #4

This feels like a case of "It rather involved being on the other side of this airtight hatchway"[1]. If you can read arbitrary process memory, you're probably also in a position to just dump out the passwords by pretending to be the user in question. > If an attacker gains administrative access on a terminal server, they can access the memory of all logged‑on user processes. If an attacker has administrative access,…

There's little hope of protecting against a snooper seeing the passwords you actually use, since they have to exist in plaintext at some point. But there's no reason to expose the entire password database when no passwords are even being used.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#35

Post by Someone1234 »

busterarm wrote: post #13

For anyone that thinks this is an Edge-specific dunk, Chrome does not hash your passwords and they are cleartext in memory while Chrome is running (which for most users is always).

Password hashes are one-directional lossy storage. If a password manager "hashed your password" it would be essentially deleting your password and replacing it with something else which cannot be used to log into anything. The password MUST be recoverable to plain-text to replay it to a website.

But you're correct that Chrome, Firefox, Edge, Lastpass, BitWarden, even Keepass have the same issue. It is an Operating System limitation, not a password manager problem.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#36

Post by jmclnx »

In this day and time Microsoft should really know better. But I have seen this, and worse, happen over and over again in some fortune 500 companies with ERP and in-house systems.

I would think this is a local vulnerability assuming Windows works as other OSs.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#37

Post by vondur »

washingupliquid wrote: post #29
thumbsup-_- wrote: post #20

Its Microsoft doing Microsoft things

Linux stores plenty of passwords in clear text in /etc and $HOME and this is considered acceptable by most users. These same people also believe the TPM is a spy chip.

Really in /etc plain text? I could see some random app possibly doing that somewhere in ~/.config, but I don't think Linux itself stores passwords in plain text for systemwide use.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#38

Post by wat10000 »

Someone1234 wrote: post #16
WolfeReader wrote: post #9

Please use a dedicated password manager, instead of a browser-based one. KeePass is likely the best going forward.

If it is a process, running in the same user context, with the ability to read/dump arbitrary memory -- As the KeePass database is decrypted it would "store all passwords in memory in plain text" too. The fix isn't Edge Vs. Chrome. Vs KeePass Vs. Bitwarden, it is "How do I have my passwords exist in a different execution context than [evil process able to read all memory]?" Android and iOS have an "answer" to this pr…

I'm pretty sure macOS is more like iOS in this respect. At the very least, the passwords are typically secured biometrically and only the one being used is actually decrypted at the time of use.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#39

Post by gruez »

turtlebits wrote: post #12
gruez wrote: post #4

This feels like a case of "It rather involved being on the other side of this airtight hatchway"[1]. If you can read arbitrary process memory, you're probably also in a position to just dump out the passwords by pretending to be the user in question. > If an attacker gains administrative access on a terminal server, they can access the memory of all logged‑on user processes. If an attacker has administrative access,…

Security isn't black and white. If i leave a post-it note of my logins on my monitor, that's definitely less safe than in a unlocked drawer, and so on.

> If i leave a post-it note of my logins on my monitor, that's definitely less safe than in a unlocked drawer, and so on.

Having passwords on post-it notes does make certain types of attacks much easier. For instance, coworkers hacking other coworkers, or people burglarizing the office. None of which really apply to the "If an attacker gains administrative access on a terminal server" scenario.

Continuing the analogy, what Edge is doing is like leaving cash in unlocked cabinets inside a vault, and what Chrome's doing is locking those cabinets with a padlock. Sure, having the padlocks makes the cash more secure, but if someone went through all the effort into breaking the vault (terminal server), a padlock probably isn't going to stop them. This is especially true nowadays with AI coding agents and ready-made stealers available for sale online.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#40

Post by dvt »

Dwedit wrote: post #31
gruez wrote: post #4

This feels like a case of "It rather involved being on the other side of this airtight hatchway"[1]. If you can read arbitrary process memory, you're probably also in a position to just dump out the passwords by pretending to be the user in question. > If an attacker gains administrative access on a terminal server, they can access the memory of all logged‑on user processes. If an attacker has administrative access,…

Reading arbitrary process memory can be done as a standard user. No admin needed. Any Win32 program can do it. You just can't access the memory from processes that are admin-level.

This is not true. The canonical way to prevent access is via PAGE_NOACCESS[1]. Obviously, running as admin or in kernel mode breaks the whole thing since you can re-call `VirtualProtect` on that page and open it up.

[1] https://learn.microsoft.com/en-us/windows/win32/memory/memor...

Post reply on HN