Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Chrome security flaw offers unrestricted password access

theguardian.com

Post reply on HN
Print view View original

41–50 of 95 posts

Re: Google Chrome security flaw offers unrestricted password access

#41

Post by carlosrg »

interpol_p wrote: post #29
Hello71 wrote: post #28

Earlier quoted context omitted.

javascript:var a=document.querySelectorAll("input[type='password']");for(var i=a.length-1;i>=0;i--){a[i].type="text"}void 0

You will have to do that for each site you want passwords for, after they have been autofilled (whereas Chrome gives you a convenient list of all saved passwords). It is also a far more technical method than most people are comfortable with. Slower and more difficult, thus less likely to happen casually. There is also a significant difference in feeling between the two methods. Your suggestion requires far more inten…

Exactly. Comparing that javascript with the Chrome situation is just ridiculous. It seems people here are too narrow-minded to understand that even my mother could get a list of all the passwords stored in a computer in 10 seconds.

Re: Google Chrome security flaw offers unrestricted password access

#42

Post by peterwwillis »

Right-click page

Click 'View page info'

Click 'Security'

Click 'View Cookies'

I just bypassed your Firefox/Safari/etc master password and owned your session. OH NOES, SECURITY FLAW!!!! (I also downloaded a rootkit and installed it in your user's home directory, but you probably don't find that as much of a flaw as me getting your cookies. Right?)

I will say that encrypting the passwords on-disk is a nice thing if you care about cold-rebooted disk attacks and don't implement disk encryption yourself. But the game is mostly over if they have access to your machine. If the machine is still on, a DMA or cold boot attack is probably going to net them the passwords even on a master-password-locked browser, because the browser still needs to access the passwords for forms without prompting you every time.

Re: Google Chrome security flaw offers unrestricted password access

#43

Post by carlosrg »

mechanical_fish wrote: post #39
carlosrg wrote: post #21

Earlier quoted context omitted.

It is a security flaw, and a big one. The only embarrassing thing here is Google's employees attempts at downplaying this. And please explain how to bypass Safari password manager, or 1Password, or any password manager with a master password, if you believe it's only a cosmetic feature.

Justin Schuh had a nice capsule summary of some available techniques for compromising logins: https://news.ycombinator.com/item?id=6166731 - dump all your session cookies - grab your history - install malicious extension to intercept all your browsing activity - install OS user account level monitoring software The last one could plausibly work, in combination with "grab a copy of the encrypted 1Password key file", t…

None of these are comparable to having a full-featured, user friendly GUI to grab all your passwords accessible with a simple "chrome://settings/passwords".

Re: Google Chrome security flaw offers unrestricted password access

#44

Post by rmc »

interpol_p wrote: post #38
Amadou wrote: post #35

Earlier quoted context omitted.

It is far more likely I am using your machine with you, and then you walk out for 20 seconds to get a glass of water. You are presuming a specific environment and an attack specific to that environment. At first glance, it may look like adding the extra complexity of a password through the obvious user-interface path improves security. But that assumes there are no costs. In this case the cost is a false sense of sec…

If Chrome was concerned about your sense of security it would inform you that all your saved passwords are clearly readable in plaintext at chrome://settings/passwords. It would do this each time it saved a password. It does not do this because you would be less likely to trust Chrome with your passwords if it did that. So Chrome wants you to feel secure and give you convenience. Either it makes some attempt to preve…

It would do this each time it saved a password.

And that's the logic behind Clippy. "It looks like you're saving a password? Did you know that if you to chome://indecipherable/arcane/nonsnese/ all your passwords are visible? Click [OK] to agree"

What do you think about the recent EU/UK cookie law? You're basically suggesting that for password.

Re: Google Chrome security flaw offers unrestricted password access

#45

Post by Amadou »

interpol_p wrote: post #38
Amadou wrote: post #35

Earlier quoted context omitted.

It is far more likely I am using your machine with you, and then you walk out for 20 seconds to get a glass of water. You are presuming a specific environment and an attack specific to that environment. At first glance, it may look like adding the extra complexity of a password through the obvious user-interface path improves security. But that assumes there are no costs. In this case the cost is a false sense of sec…

If Chrome was concerned about your sense of security it would inform you that all your saved passwords are clearly readable in plaintext at chrome://settings/passwords. It would do this each time it saved a password. It does not do this because you would be less likely to trust Chrome with your passwords if it did that. So Chrome wants you to feel secure and give you convenience. Either it makes some attempt to preve…

If Chrome was concerned about your sense of security it would inform you that all your saved passwords are clearly readable in plaintext

I completely agree with that, I think that would be a much more useful fix.

Re: Google Chrome security flaw offers unrestricted password access

#46

Post by rmc »

carlosrg wrote: post #41
interpol_p wrote: post #29

Earlier quoted context omitted.

You will have to do that for each site you want passwords for, after they have been autofilled (whereas Chrome gives you a convenient list of all saved passwords). It is also a far more technical method than most people are comfortable with. Slower and more difficult, thus less likely to happen casually. There is also a significant difference in feeling between the two methods. Your suggestion requires far more inten…

Exactly. Comparing that javascript with the Chrome situation is just ridiculous. It seems people here are too narrow-minded to understand that even my mother could get a list of all the passwords stored in a computer in 10 seconds.

Your mother knows about chrome:// URLs? Most mundane/non-technical people I know don't know about URLs at all? My mother still types "www.facebook.com" into the Google search bar on google.com.

Re: Google Chrome security flaw offers unrestricted password access

#47

Post by interpol_p »

interpol_p wrote: post #38
Amadou wrote: post #35

Earlier quoted context omitted.

It is far more likely I am using your machine with you, and then you walk out for 20 seconds to get a glass of water. You are presuming a specific environment and an attack specific to that environment. At first glance, it may look like adding the extra complexity of a password through the obvious user-interface path improves security. But that assumes there are no costs. In this case the cost is a false sense of sec…

If Chrome was concerned about your sense of security it would inform you that all your saved passwords are clearly readable in plaintext at chrome://settings/passwords. It would do this each time it saved a password. It does not do this because you would be less likely to trust Chrome with your passwords if it did that. So Chrome wants you to feel secure and give you convenience. Either it makes some attempt to preve…

To rmc:

> And that's the logic behind Clippy.

No, it absolutely is not. Chrome already asks and informs you that it is saving your password. It asks each time it saves a password. It already does this. It would simply be an additional line of information in a step that you already have to confirm by clicking "Ok".

Re: Google Chrome security flaw offers unrestricted password access

#48

Post by tptacek »

interpol_p wrote: post #22
tptacek wrote: post #10

This is embarrassing. What The Guardian (and, earlier, HN) is describing simply isn't a security flaw; rather, HN appears to have had a mild temper tantrum over the lack of a cosmetic "security" feature that, had Chrome implemented it, could have just as easily led to another temper tantrum over how easy it is to bypass.

I am unsure why Chrome does not ask for the master password when the user attempts to reveal the plaintext for a password. Safari does this and it works. This is a big deal because it makes reading passwords easy to do in seconds, and easy to do inconspicuously. If you were to modify the DOM to unmask passwords it would take longer, and it's not something you can do while a co-worker or friend lends you their laptop…

It does not work. It is a cosmetic security feature. If you don't log out, the next unauthorized user owns your account. You obviously know that. You're talking about a security feature based entirely off the incompetence of attackers. Why not also recommend that Chrome "Base64 encrypt" passwords? That will stop approximately the same set of attackers as the lack of a master password feature will.

Re: Google Chrome security flaw offers unrestricted password access

#49

Post by tptacek »

joekrill wrote: post #40
smtddr wrote: post #34

I don't think it's fair to call something a flaw because you disagree with it. Google didn't do this by accident. It's a very purposely designed feature that apparently a bunch of HN-folks just learned about and strongly disagree with. Also, Firefox does this too... And for the record, when I saw this feature 2 years ago I disagreed with it too - but it's not a flaw.

I absolutely agree. Although Firefox at least gives you the ability to set a master password to add additional security. Chrome does not.

They deliberately do not, because that password doesn't solve any security problems, but does communicate to users that Chrome is doing something to protect their account that it doesn't and can't do.

Firefox should lose the feature.

Re: Google Chrome security flaw offers unrestricted password access

#50

Post by tptacek »

carlosrg wrote: post #41
interpol_p wrote: post #29

Earlier quoted context omitted.

You will have to do that for each site you want passwords for, after they have been autofilled (whereas Chrome gives you a convenient list of all saved passwords). It is also a far more technical method than most people are comfortable with. Slower and more difficult, thus less likely to happen casually. There is also a significant difference in feeling between the two methods. Your suggestion requires far more inten…

Exactly. Comparing that javascript with the Chrome situation is just ridiculous. It seems people here are too narrow-minded to understand that even my mother could get a list of all the passwords stored in a computer in 10 seconds.

"Even my mother"? So what? Both Firefox and Chrome are, when left on an unlocked user account, completely exposed to the scariest classes of attackers. But Firefox has taken a cosmetic step to minimize its exposure to the least scary class of attackers. Why bother?
Post reply on HN