Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft Edge stores all passwords in memory in clear text, even when unused

twitter.com

Post reply on HN
Print view View original

51–60 of 243 posts

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#51

Post by jazzyjackson »

ignoramous wrote: post #47
Someone1234 wrote: post #30

Earlier quoted context omitted.

Right; but in the scenario of this Tweek, you've invited someone untrustworthy into the vault and are then freaking out because they can see the post-it note of passwords. It is inherently irrational. This issue is inherently unfixable by ANY password manager, because the process model of the underlying OS isn't itself secure. No obfuscation will work, because the password manager itself needs to de-obfuscation it be…

> This issue is inherently unfixable by ANY password manager, because the process model of the underlying OS isn't itself secure Usually the confidential bits are hardware isolated away from the supervisor (host kernel/OS) in Enclaves/TEEs, Realms, Secure Elements, Security chips, etc.

One more reason to use hardware-bound passkeys and not passwords.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#52

Post by Someone1234 »

dvt wrote: post #40
Dwedit wrote: post #31

Earlier quoted context omitted.

Reading arbitrary process memory can be done as a standard user. No admin needed. Any Win32 program can do it. You just can't access the memory from processes that are admin-level.

This is not true. The canonical way to prevent access is via PAGE_NOACCESS[1]. Obviously, running as admin or in kernel mode breaks the whole thing since you can re-call `VirtualProtect` on that page and open it up. [1] https://learn.microsoft.com/en-us/windows/win32/memory/memor...

This is accurate as far as page protection goes. The problem is the largest threat model.

If Process A and Process B are running in the same user context on a desktop OS, PAGE_NOACCESS is not a strong boundary by itself. Process B may be able to obtain PROCESS_VM_OPERATION/PROCESS_VM_READ, change the page protection with VirtualProtectEx, inject code that calls VirtualProtect inside Process A, load a DLL, attach as a debugger, duplicate useful handles, or tamper with the executable. That's the problem with same-user process isolation, it is a hugely leaky abstraction. There is no magical "just set this bit" fix.

On a desktop OS, once an evil process runs under the same user context, you are relying on process DACLs, integrity levels, code-signing, anti-injection hardening, and file-system protections. You can plug one path and still have several others.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#53

Post by RajT88 »

turtlebits wrote: post #12
gruez wrote: post #4

This feels like a case of "It rather involved being on the other side of this airtight hatchway"[1]. If you can read arbitrary process memory, you're probably also in a position to just dump out the passwords by pretending to be the user in question. > If an attacker gains administrative access on a terminal server, they can access the memory of all logged‑on user processes. If an attacker has administrative access,…

Security isn't black and white. If i leave a post-it note of my logins on my monitor, that's definitely less safe than in a unlocked drawer, and so on.

The way to think about security is as a system of layers, each of which filters out ever more sophisticated attackers.

We should care about all kinds of attackers, and not assume that the protections against the most sophisticated will obviate the protections against the least sophisticated.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#54

Post by yjftsjthsd-h »

turtlebits wrote: post #12
gruez wrote: post #4

This feels like a case of "It rather involved being on the other side of this airtight hatchway"[1]. If you can read arbitrary process memory, you're probably also in a position to just dump out the passwords by pretending to be the user in question. > If an attacker gains administrative access on a terminal server, they can access the memory of all logged‑on user processes. If an attacker has administrative access,…

Security isn't black and white. If i leave a post-it note of my logins on my monitor, that's definitely less safe than in a unlocked drawer, and so on.

Okay. Can you describe an attack / threat model where it would matter in this particular case?

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#55

Post by jazzyjackson »

WolfeReader wrote: post #17
75central wrote: post #10

Earlier quoted context omitted.

Out of curiosity, why KeePass versus Bitwarden? I've been using Bitwarden for years, but if there's a specific reason I should be using KeePass instead, I'm open to changing.

Bitwarden has taken investor money, sadly. It's still in good shape for the moment. But the time will come when they place profits above other needs; it's a matter of when, not if.

Luckily offering enterprise / credential sharing features is a decent freemium model. It still wins out in keeping compatibility with self hosted vaultwarden, are there other extensions that let you point to your own domain for the encrypted blob storage?

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#56

Post by jazzyjackson »

Someone1234 wrote: post #16
WolfeReader wrote: post #9

Please use a dedicated password manager, instead of a browser-based one. KeePass is likely the best going forward.

If it is a process, running in the same user context, with the ability to read/dump arbitrary memory -- As the KeePass database is decrypted it would "store all passwords in memory in plain text" too. The fix isn't Edge Vs. Chrome. Vs KeePass Vs. Bitwarden, it is "How do I have my passwords exist in a different execution context than [evil process able to read all memory]?" Android and iOS have an "answer" to this pr…

Windows 11* and MacOS also do the job as long as you're using hardware bound passkeys.

* I don't want to speak past my own experience so checking my work, Windows can store passkeys in a TPM if available but falls back to storing on disk... https://helgeklein.com/blog/checking-windows-hello-for-busin...

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#57

Post by Someone1234 »

jazzyjackson wrote: post #51
ignoramous wrote: post #47

Earlier quoted context omitted.

> This issue is inherently unfixable by ANY password manager, because the process model of the underlying OS isn't itself secure Usually the confidential bits are hardware isolated away from the supervisor (host kernel/OS) in Enclaves/TEEs, Realms, Secure Elements, Security chips, etc.

One more reason to use hardware-bound passkeys and not passwords.

True. But then your hardware dies, and you're locked out of every account you own. It is objectively good security, but has a ton of usability headaches yet to be really solved.

I've seen orgs move to passkeys only, then offer reset-questions (e.g. city of first job, etc); because the Customer Service volume/workflow wasn't figured out.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#58

Post by keithnz »

yjftsjthsd-h wrote: post #54
turtlebits wrote: post #12

Earlier quoted context omitted.

Security isn't black and white. If i leave a post-it note of my logins on my monitor, that's definitely less safe than in a unlocked drawer, and so on.

Okay. Can you describe an attack / threat model where it would matter in this particular case?

isn't it at risk of any code pathway that somehow allows you exceed a buffer and read memory unbounded? Then a nefarious web page could capture that? That's a huge exposure surface.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#59

Post by dvt »

Someone1234 wrote: post #52
dvt wrote: post #40

Earlier quoted context omitted.

This is not true. The canonical way to prevent access is via PAGE_NOACCESS[1]. Obviously, running as admin or in kernel mode breaks the whole thing since you can re-call `VirtualProtect` on that page and open it up. [1] https://learn.microsoft.com/en-us/windows/win32/memory/memor...

This is accurate as far as page protection goes. The problem is the largest threat model. If Process A and Process B are running in the same user context on a desktop OS, PAGE_NOACCESS is not a strong boundary by itself. Process B may be able to obtain PROCESS_VM_OPERATION/PROCESS_VM_READ, change the page protection with VirtualProtectEx, inject code that calls VirtualProtect inside Process A, load a DLL, attach as a…

This comment feels like it's written by AI. Anyway, PAGE_GUARD helps you get around VirtualProtectEx, which is a very common way of detecting userspace cheats.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#60

Post by jazzyjackson »

Someone1234 wrote: post #57
jazzyjackson wrote: post #51

Earlier quoted context omitted.

One more reason to use hardware-bound passkeys and not passwords.

True. But then your hardware dies, and you're locked out of every account you own. It is objectively good security, but has a ton of usability headaches yet to be really solved. I've seen orgs move to passkeys only, then offer reset-questions (e.g. city of first job, etc); because the Customer Service volume/workflow wasn't figured out.

oh lawd, yes it does come down to 'who has the power to reset your account', and very few people want to take the path of 'no one has the power' in the case of lost credentials.
Post reply on HN