mmmmhhhh. Salted peanuts
Key for chromium's encrypted cookies store in Linux is “peanuts”
31–40 of 59 posts
Re: Key for chromium's encrypted cookies store in Linux is “peanuts”
#32This is misleading. If you follow the links to the Chromium bug tracker, you'll note that Chrome integrates with the GNOME and KDE encrypted password managers when they're available. If they're not, it falls back to storing passwords itself with obfuscation, which is the best it can do. (On Windows and OS X, it uses CryptProtectData and the Keychain API, respectively.) https://code.google.com/p/chromium/wiki/LinuxPas…
> If they're not, it falls back to storing passwords itself with obfuscation, which is the best it can do.
No, the best it could do is to have a master password, provided at launch.
I'm really concerned about the extent to which neither Google nor Mozilla actually cares about user security. No plaintext password should ever live somewhere outside of the user's head; no password encrypted with a user-memorable password should live outside of a computer under the user's physical control. Thus, passwords (and other private data) on remote systems should always be encrypted with secure keys, themselves generated on the user's device and encrypted on his device with his memorable password.
The facts that by default Google will store your website and WiFi passwords (along with your emails and pictures) in plaintext on their servers, and that Mozilla utterly destroyed the security of their sync system, are utterly sickening.
Re: Key for chromium's encrypted cookies store in Linux is “peanuts”
#33Re: Key for chromium's encrypted cookies store in Linux is “peanuts”
#34"ksalt - at least salt is a variable, surely it at least is randomly generated, right?" > // Salt for Symmetric key derivation. > const char kSalt[] = "saltysalt";
Reading this was like seeing a ray of hope being shot down by a minigun. In seriousness, what gives!? Why are these so simple? Surely a development base as large as Chromium's could pick up on something like this.
It's a good software development principle. Make things that are secure look secure. Make things that are insecure look insecure. This is going to be insecure no matter what precautions are taken, because the source is open and the key is part of the binary, so it should look exactly as insecure as it is so no one assumes anything untrue about this code.
Re: Key for chromium's encrypted cookies store in Linux is “peanuts”
#35This is misleading. If you follow the links to the Chromium bug tracker, you'll note that Chrome integrates with the GNOME and KDE encrypted password managers when they're available. If they're not, it falls back to storing passwords itself with obfuscation, which is the best it can do. (On Windows and OS X, it uses CryptProtectData and the Keychain API, respectively.) https://code.google.com/p/chromium/wiki/LinuxPas…
> If they're not, it falls back to storing passwords itself with obfuscation, which is the best it can do. No, the best it could do is to have a master password, provided at launch. I'm really concerned about the extent to which neither Google nor Mozilla actually cares about user security. No plaintext password should ever live somewhere outside of the user's head; no password encrypted with a user-memorable passwor…
Expecting privacy (or privacy-preserving security) from Google products has always been folly.
Mozilla used to be different. However, when Brendan was purged, first doubts may have arisen. Now that we also see cyber-bully Klabnik on their payroll, the probability has risen sharply that Mozilla has been successfully subverted into a political pressure group.
Since Mozilla now is enrolled in support of the dominant ideology, it has no incentive for supporting privacy anymore, either: The dominant ideology wants minority opinion holders to be outed and ostracised.
Re: Key for chromium's encrypted cookies store in Linux is “peanuts”
#36Well without having a user-specified master password like firefox has, you're bound to use some "pseudosecret" keys.
System credential managers are the established way to do this properly. They are user configurable, generally maintain credentials in a separate security context, derive a strong key from the user logon credential, can more easily support hardware security mechanisms, and introduce minimum user friction by default. That's why Chrome and most browsers prefer the system credential managers when available (on Linux: libsecret, Gnome Keyring, or KWallet).
The application specific "master password" is more of an anti-pattern for effective credential storage. The most glaring issue is that user friction is so high that it's rarely ever enabled, because it's just too inconvenient and confusing for most people. But beyond that it has the weaknesses typical to any credential manager not deeply integrated into the OS (e.g. credential management is handled entirely in the user's context, management is inconsistent between applications, etc.).
Re: Key for chromium's encrypted cookies store in Linux is “peanuts”
#37Earlier quoted context omitted.
> If they're not, it falls back to storing passwords itself with obfuscation, which is the best it can do. No, the best it could do is to have a master password, provided at launch. I'm really concerned about the extent to which neither Google nor Mozilla actually cares about user security. No plaintext password should ever live somewhere outside of the user's head; no password encrypted with a user-memorable passwor…
Expecting privacy (or privacy-preserving security) from Google products has always been folly. Mozilla used to be different. However, when Brendan was purged, first doubts may have arisen. Now that we also see cyber-bully Klabnik on their payroll, the probability has risen sharply that Mozilla has been successfully subverted into a political pressure group. Since Mozilla now is enrolled in support of the dominant ide…
How could I not think of that! Hiring a kind of SJW-ey guy to write Rust docs is just a small step in the direction of clear-text passwords and the removal of HTTPS from Firefox. Better switch to Gnome Web, then.
Re: Key for chromium's encrypted cookies store in Linux is “peanuts”
#38Earlier quoted context omitted.
Expecting privacy (or privacy-preserving security) from Google products has always been folly. Mozilla used to be different. However, when Brendan was purged, first doubts may have arisen. Now that we also see cyber-bully Klabnik on their payroll, the probability has risen sharply that Mozilla has been successfully subverted into a political pressure group. Since Mozilla now is enrolled in support of the dominant ide…
How could I not think of that! Hiring a kind of SJW-ey guy to write Rust docs is just a small step in the direction of clear-text passwords and the removal of HTTPS from Firefox. Better switch to Gnome Web, then.
If Mozilla was a-political, Klabnik couldn't work there if Brendan couldn't. He can, and Mozilla isn't.
Actually, the politicalization of Mozilla means that everything technical will lose priority over time.
Re: Key for chromium's encrypted cookies store in Linux is “peanuts”
#39This is misleading. If you follow the links to the Chromium bug tracker, you'll note that Chrome integrates with the GNOME and KDE encrypted password managers when they're available. If they're not, it falls back to storing passwords itself with obfuscation, which is the best it can do. (On Windows and OS X, it uses CryptProtectData and the Keychain API, respectively.) https://code.google.com/p/chromium/wiki/LinuxPas…
> If they're not, it falls back to storing passwords itself with obfuscation, which is the best it can do. No, the best it could do is to have a master password, provided at launch. I'm really concerned about the extent to which neither Google nor Mozilla actually cares about user security. No plaintext password should ever live somewhere outside of the user's head; no password encrypted with a user-memorable passwor…
> Google will store your website and WiFi passwords (along with your emails and pictures) in plaintext on their servers
You're going to need to qualify that statement.
> Mozilla utterly destroyed the security of their sync system
You're going to need to qualify that statement.
Re: Key for chromium's encrypted cookies store in Linux is “peanuts”
#40Earlier quoted context omitted.
> If they're not, it falls back to storing passwords itself with obfuscation, which is the best it can do. No, the best it could do is to have a master password, provided at launch. I'm really concerned about the extent to which neither Google nor Mozilla actually cares about user security. No plaintext password should ever live somewhere outside of the user's head; no password encrypted with a user-memorable passwor…
> Google will store your website and WiFi passwords (along with your emails and pictures) in plaintext on their servers You're going to need to qualify that statement. > Mozilla utterly destroyed the security of their sync system You're going to need to qualify that statement.
About the first thing: he means that Google stores them in a way so that they can access the data – instead of doing end to end crypto with a password derived key.