Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Browsers Store Your Passwords (and Why You Shouldn't Let Them)

raidersec.blogspot.in

Post reply on HN
Print view View original

31–40 of 82 posts

Re: How Browsers Store Your Passwords (and Why You Shouldn't Let Them)

#31

Post by UnoriginalGuy »

jrochkind1 wrote: post #27

Chrome OSX stores in OSX keychain, out of the box. Which is a fairly secure way to store passwords.

Let's assume for the sake of argument that we are running code on both a Windows machine and an OS X machine, and trying to steal someone's browser passwords.

While it is undeniable that the OSX keychain adds a roadblock to the theft, many average users would happily enter their password if the box was displayed when they ran up their browser (even if the browser wasn't the originating process) and likely also fall for a fake keychain prompt.

I think the keychain is a good thing (just as it is in Android). Just wanted to make the point that the keychain for your average non-power user is a minor roadblock in theft, rather than a "real" security feature.

Re: How Browsers Store Your Passwords (and Why You Shouldn't Let Them)

#33

Post by jwcrux »

mikeleeorg wrote: post #12

Also in Chrome: Go to Settings -> Show advanced settings -> Manage saved passwords -> Click on a "hidden" password -> Click on "Show" button -> Voila, password shown in plain text

Absolutely! This functionality is present in most (if not all) browsers. The goal of this post was to show how malware could automatically attempt to extract all credentials.

However, that's certainly a good feature to mention!

Re: How Browsers Store Your Passwords (and Why You Shouldn't Let Them)

#34

Post by jwcrux »

graycat wrote: post #15

His Web page commonly has 128 characters per line. So, on a 17" monitor, the page is just unreadable.

Hi there! Sorry about the resolution issue.. I'm using Google's blogspot with settings not adjusted too much (only widened a few things, etc.)

Any suggestions as to what I could do to help you read the content?

Re: How Browsers Store Your Passwords (and Why You Shouldn't Let Them)

#35

Post by columbo »

mjschultz wrote: post #18

Here is a recent discussion on chromium-dev about the password manager: https://groups.google.com/a/chromium.org/forum/#!searchin/ch... Evidently, only 0.0085% of users toggle on the "Use a master password"

I think the percentage is interesting, but it adds nothing for either side of the debate (either for or against). I'm not challenging you, I'm talking about the people going back to that number in the thread you posted.

* I don't even know how to setup a master password and have never heard of the option being available in FF or Chrome. I also don't know what it does. Does it replace all password boxes with a master-password that you enter which then pulls down the appropriate password? Is it a keychain?

Saying "X people don't use this feature" could mean anything. It could mean the feature is buried in the system, or that the feature isn't descriptive enough, or that the feature is hard to understand... it doesn't default to being "people clearly don't want that feature".

[*] I could research it, but I'm giving you my current uneducated opinion to make a point.

Re: How Browsers Store Your Passwords (and Why You Shouldn't Let Them)

#36

Post by jwcrux »

mjschultz wrote: post #16
jwcrux wrote: post #7

Earlier quoted context omitted.

Hi there! Thanks for the great comment. I had a similar one on my blog that I responded to in the following way (I hope it helps!): "Good question! You're right - in these cases it is assumed malware is already present on the system and running in the context of the user. But there can simply be better protection. Consider Firefox's use of a Master Password. Even if an attacker is on the otherside of the airtight hat…

But if there is already malware on the user system, it just needs to wait until the user authenticates once in Firefox to get the master password, then it can fetch all the other passwords. Right?

Absolutely it could. However, the layer of defense provided by a master password is still (so far, seemingly) better than the instantaneous and automatic access to credentials malware could have when extracting credentials from Chrome and IE.

But yes, to answer your question (and to validate the other poster on this thread) - If malware infects your system, you will likely have a bad time.

Re: How Browsers Store Your Passwords (and Why You Shouldn't Let Them)

#37

Post by acdha »

jwcrux wrote: post #36
mjschultz wrote: post #16

Earlier quoted context omitted.

But if there is already malware on the user system, it just needs to wait until the user authenticates once in Firefox to get the master password, then it can fetch all the other passwords. Right?

Absolutely it could. However, the layer of defense provided by a master password is still (so far, seemingly) better than the instantaneous and automatic access to credentials malware could have when extracting credentials from Chrome and IE. But yes, to answer your question (and to validate the other poster on this thread) - If malware infects your system, you will likely have a bad time.

I think you're answering in good faith but I find that caveat so overwhelming that it makes the point meaningless: if malware runs locally outside of a sandbox, you're screwed – full stop, end of story.

There are scenarios where master passwords are extremely useful and that's passive file disclosure such as a network home directory, a compromise of another account while you're not logged in, or – particularly relevant these days – a breached cloud sync service. I would make the case for that reason rather than as a malware resistance measure.

The long term fix requires architectural changes: none of the attacks described work directly on Mac OS X because the Keychain decoding happens in the securityd process which runs as root so the malware would trigger a confirmation prompt for each password it tried to pilfer. Unfortunately, this is also less than perfect as most users check the “Always allow” box granting permission to their browser for unprompted access…

Re: How Browsers Store Your Passwords (and Why You Shouldn't Let Them)

#38

Post by acdha »

jarek wrote: post #30
newman314 wrote: post #13

Earlier quoted context omitted.

Like I said, I opt to use 1Password instead for cross platform usage.

So locally running malware only needs to keylog your master 1Password password to decrypt your 1Password data file?

This is harder than it used to be due to the secure text entry and sandboxing options which OS X has added but it's definitely the biggest risk for password manager users.

Re: How Browsers Store Your Passwords (and Why You Shouldn't Let Them)

#39

Post by acdha »

betterunix wrote: post #11

Passwords are a terrible way to authenticate people anyway. The sooner we start using certificates and smartcards, the better.

For the attack mentioned above, only one of those is actually useful. Certificates are a complete distraction from what you really need – some sort of multi-factor authentication.

Re: How Browsers Store Your Passwords (and Why You Shouldn't Let Them)

#40

Post by untog »

mjschultz wrote: post #18

Here is a recent discussion on chromium-dev about the password manager: https://groups.google.com/a/chromium.org/forum/#!searchin/ch... Evidently, only 0.0085% of users toggle on the "Use a master password"

This is a failure of the browser manufacturers, not the users. I had no idea this was even possible until now- they should surface a feature like this a lot more clearly if they want people to use it.
Post reply on HN