Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft Edge stores all passwords in memory in clear text, even when unused

twitter.com

Post reply on HN
Print view View original

61–70 of 243 posts

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#61

Post by tardedmeme »

gruez wrote: post #4

This feels like a case of "It rather involved being on the other side of this airtight hatchway"[1]. If you can read arbitrary process memory, you're probably also in a position to just dump out the passwords by pretending to be the user in question. > If an attacker gains administrative access on a terminal server, they can access the memory of all logged‑on user processes. If an attacker has administrative access,…

They want obscurity and think it's security. Everything needed to get the passwords must be present in memory but they don't want to be able to actually see the passwords directly.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#62

Post by fragmede »

cwillu wrote: post #33
washingupliquid wrote: post #29

Earlier quoted context omitted.

Linux stores plenty of passwords in clear text in /etc and $HOME and this is considered acceptable by most users. These same people also believe the TPM is a spy chip.

> Linux stores plenty of passwords in plain text in /etc That's gonna be a big ol' [CITATION NEEDED] from me, dawg.

I haven't solved the problem of sensitive .env files sitting around on my computer.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#64

Post by kelvinjps10 »

75central wrote: post #10
WolfeReader wrote: post #9

Please use a dedicated password manager, instead of a browser-based one. KeePass is likely the best going forward.

Out of curiosity, why KeePass versus Bitwarden? I've been using Bitwarden for years, but if there's a specific reason I should be using KeePass instead, I'm open to changing.

Bitwarden is cloud bases keepass is local

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#65

Post by jazzyjackson »

mfro wrote: post #8
saghm wrote: post #6

Earlier quoted context omitted.

The headline here says "stores in memory", which sounds pretty much identical to me. Can you elaborate on what you consider the difference between "loading" and "storing" into memory?

When someone says passwords are ‘stored’, the assumption will always be ‘stored on disk’. ‘stores in memory’ is not an accurate representation because memory is inherently volatile and they are loaded there temporarily. Plaintext on disk is egregious, plaintext in memory is considerably less so.

especially when the point of a password manager is to stick a plaintext string into a webpage, which then transmits the plain text to a remote server. passwords are just not a very good solution to keeping secrets.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#66

Post by abhinavk »

washingupliquid wrote: post #29
thumbsup-_- wrote: post #20

Its Microsoft doing Microsoft things

Linux stores plenty of passwords in clear text in /etc and $HOME and this is considered acceptable by most users. These same people also believe the TPM is a spy chip.

You know `/etc/passwd` doesn't really have passwords in it.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#67

Post by tgv »

vondur wrote: post #37
washingupliquid wrote: post #29

Earlier quoted context omitted.

Linux stores plenty of passwords in clear text in /etc and $HOME and this is considered acceptable by most users. These same people also believe the TPM is a spy chip.

Really in /etc plain text? I could see some random app possibly doing that somewhere in ~/.config, but I don't think Linux itself stores passwords in plain text for systemwide use.

I think the commenter means that some Linux applications store the passwords they need for access to external resources in plain text.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#68

Post by ylk »

For reference, this is how Google says Chrome stores passwords encrypted in memory and uses an elevated service to prevent other processes from impersonating Chrome and gaining access to the plain text passwords: https://security.googleblog.com/2024/07/improving-security-o...

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#69

Post by Dylan16807 »

keithnz wrote: post #58
yjftsjthsd-h wrote: post #54

Earlier quoted context omitted.

Okay. Can you describe an attack / threat model where it would matter in this particular case?

isn't it at risk of any code pathway that somehow allows you exceed a buffer and read memory unbounded? Then a nefarious web page could capture that? That's a huge exposure surface.

I'm pretty sure a read exploit in a web page wouldn't be in the same process as the passwords.

If you can cross over to the main Edge process, you can probably get it to remove any encryption it applied itself.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#70

Post by alterom »

Someone1234 wrote: post #57
jazzyjackson wrote: post #51

Earlier quoted context omitted.

One more reason to use hardware-bound passkeys and not passwords.

True. But then your hardware dies, and you're locked out of every account you own. It is objectively good security, but has a ton of usability headaches yet to be really solved. I've seen orgs move to passkeys only, then offer reset-questions (e.g. city of first job, etc); because the Customer Service volume/workflow wasn't figured out.

>your hardware dies

Or your backpack gets stolen.

Oops.

I swear, people who idolize passkey security must never travel anywhere.

PS: "just have more devices with passkeys", they invariably say.

Yeah right because people are made of money, everyone has the forethought, and a 2nd laptop in the US is a great asset when you're in Poland and can't login anywhere.

Post reply on HN