That's kinda stupid. The passwords could get swapped to disk in the swap file in plaintext when memory is low by the OS.
You say this as if accessing that file was any easier than accessing memory.
Microsoft Edge stores all passwords in memory in clear text, even when unused
71–80 of 243 posts
Re: Microsoft Edge stores all passwords in memory in clear text, even when unused
#72That's kinda stupid. The passwords could get swapped to disk in the swap file in plaintext when memory is low by the OS.
You say this as if accessing that file was any easier than accessing memory.
If I have a disk image or access to the physical drive, it's trivial. This means they can no longer be considered encrypted at rest.
Re: Microsoft Edge stores all passwords in memory in clear text, even when unused
#73This feels like a case of "It rather involved being on the other side of this airtight hatchway"[1]. If you can read arbitrary process memory, you're probably also in a position to just dump out the passwords by pretending to be the user in question. > If an attacker gains administrative access on a terminal server, they can access the memory of all logged‑on user processes. If an attacker has administrative access,…
Have we already forgotten Cloudbleed [0]?
Re: Microsoft Edge stores all passwords in memory in clear text, even when unused
#74I don't understand, who are all these people who care about security and at the same time are using Microsoft Edge. Could someone enlighten me? Does it have some specific features that somebody needs?
Re: Microsoft Edge stores all passwords in memory in clear text, even when unused
#75Earlier quoted context omitted.
> Linux stores plenty of passwords in plain text in /etc That's gonna be a big ol' [CITATION NEEDED] from me, dawg.
I haven't solved the problem of sensitive .env files sitting around on my computer.
`sops exec-env`
I have an alias set for when I'm working with opentofu:
`alias tfenter='sops exec-env secrets.yaml "/bin/bash"'`
I encrypt with openbao's transit engine and backup age key kept in a password manager, so no secrets live on disk.
Re: Microsoft Edge stores all passwords in memory in clear text, even when unused
#76Edge is built by a company not focusing on user data-protection, so no surprise here. At least Brave and Firefox are usable and actual competitors, but have a business model based on user security rather than data.
Re: Microsoft Edge stores all passwords in memory in clear text, even when unused
#77Earlier quoted context omitted.
True. But then your hardware dies, and you're locked out of every account you own. It is objectively good security, but has a ton of usability headaches yet to be really solved. I've seen orgs move to passkeys only, then offer reset-questions (e.g. city of first job, etc); because the Customer Service volume/workflow wasn't figured out.
>your hardware dies Or your backpack gets stolen. Oops. I swear, people who idolize passkey security must never travel anywhere. PS: "just have more devices with passkeys", they invariably say. Yeah right because people are made of money, everyone has the forethought, and a 2nd laptop in the US is a great asset when you're in Poland and can't login anywhere.
I've been avoiding passkeys but more and more websites are trying to push them, and one website I use now requires them. I've already got a password manager! I don't need to change everything again!
Re: Microsoft Edge stores all passwords in memory in clear text, even when unused
#78I think in general one should not assume anything in Edge is done correctly. Microsoft Edge is the place where things get tried out my Microsoft, that's why it changes so fast. It has a built-in updater that is not tied to Windows update, and as such they can iterate incredibly fast.
Re: Microsoft Edge stores all passwords in memory in clear text, even when unused
#79Earlier quoted context omitted.
When someone says passwords are ‘stored’, the assumption will always be ‘stored on disk’. ‘stores in memory’ is not an accurate representation because memory is inherently volatile and they are loaded there temporarily. Plaintext on disk is egregious, plaintext in memory is considerably less so.
especially when the point of a password manager is to stick a plaintext string into a webpage, which then transmits the plain text to a remote server. passwords are just not a very good solution to keeping secrets.
Never enter your password into a website that doesn't use https.
Re: Microsoft Edge stores all passwords in memory in clear text, even when unused
#80Earlier quoted context omitted.
This is not true. The canonical way to prevent access is via PAGE_NOACCESS[1]. Obviously, running as admin or in kernel mode breaks the whole thing since you can re-call `VirtualProtect` on that page and open it up. [1] https://learn.microsoft.com/en-us/windows/win32/memory/memor...
And if the malware is running as admin, you’re pretty fucked either way
Thankfully our recent experiences with OpenClaw have given us all a lot of faith that users are extremely diligent in what processes they allow access to what information.