Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Browsers Store Your Passwords (and Why You Shouldn't Let Them)

raidersec.blogspot.in

Post reply on HN
Print view View original

71–80 of 82 posts

Re: How Browsers Store Your Passwords (and Why You Shouldn't Let Them)

#71

Post by ggreer »

hayksaakian wrote: post #62
uptown wrote: post #25

One thing I've been meaning to test. Does Chrome's form-autofill (the thing where it fills in as much of a form as it can when you specify an email address) populate hidden fields if they match? If-so, it seems like potential for mischief to create some form inputs of type "hidden" or just some visually-hidden form inputs using style sheets to capture more information than a user is aware is being populated and submi…

No. Why would it do that.

I assume a real attack wouldn't use . Instead, you'd style the input such that the user doesn't see it, but the browser thinks it's visible. Extremely low opacity and/or an incredibly small size could do the trick. To provoke the browser into autocompleting data, you might even be able to use JavaScript to fake keystrokes in the stealth form inputs.

Front-end stuff is well outside my area of expertise, so I'm betting someone already tried these ideas and now browsers protect against them.

Re: How Browsers Store Your Passwords (and Why You Shouldn't Let Them)

#72

Post by Derbasti »

jwcrux wrote: post #33
mikeleeorg wrote: post #12

Also in Chrome: Go to Settings -> Show advanced settings -> Manage saved passwords -> Click on a "hidden" password -> Click on "Show" button -> Voila, password shown in plain text

Absolutely! This functionality is present in most (if not all) browsers. The goal of this post was to show how malware could automatically attempt to extract all credentials. However, that's certainly a good feature to mention!

Firefox requires your master password (if you have one) to view your passwords in plain text.

Re: How Browsers Store Your Passwords (and Why You Shouldn't Let Them)

#73

Post by anonymous »

jamesgeck0 wrote: post #68
Dylan16807 wrote: post #55

Earlier quoted context omitted.

How about I put it this way: "All you have to do is go to password settings and click the button" And you only have to go there once ever. I think it's usually assumed users can navigate menus, because even if they can't there's not much you can do to help them at this point.

Users can navigate menus. But given the out-of-the-way location of the "Use a master password" checkbox, what percentage of Firefox's users even know of it's existence? It's likely pretty low.

> out-of-the-way

It's right there in the security tab. TWO clicks.

1. open preferences

2. click on security

And it's RIGHT THERE. That's about as obvious as I can imagine it.

Re: How Browsers Store Your Passwords (and Why You Shouldn't Let Them)

#74

Post by emn13 »

acdha wrote: post #39
betterunix wrote: post #11

Passwords are a terrible way to authenticate people anyway. The sooner we start using certificates and smartcards, the better.

For the attack mentioned above, only one of those is actually useful. Certificates are a complete distraction from what you really need – some sort of multi-factor authentication.

Certificates (I'm assuming assymetric encryption) are better than passwords in that they aren't passed on to the receiving site. This means that sites can build databases of public keys rather than passwords, and that an attacker compromising such a site, rather than getting a password file that he can reuse all over the place, only gets a fairly useless public key which would let him identify the user. And of course there aren't any dictionary attacks for keys either.

Which isn't to say that multi-factor auth isn't a good idea, it's just that certificates are still better than passwords.

Re: How Browsers Store Your Passwords (and Why You Shouldn't Let Them)

#76

Post by saljam »

I've been thinking about this (and the more general keychain problem) recently. Wouldn't it make sense to have your keychain stored on your smartphone, and allow applications access over a standard protocol using NFC/USB/Bluetooth?

Better still, let the phone do the public key cryptography (as in plan9's factotum), so that your private keys never leave your phone.

Re: How Browsers Store Your Passwords (and Why You Shouldn't Let Them)

#77

Post by claudius »

saljam wrote: post #76

I've been thinking about this (and the more general keychain problem) recently. Wouldn't it make sense to have your keychain stored on your smartphone, and allow applications access over a standard protocol using NFC/USB/Bluetooth? Better still, let the phone do the public key cryptography (as in plan9's factotum), so that your private keys never leave your phone.

How is your phone inherently more secure than your computer?

Re: How Browsers Store Your Passwords (and Why You Shouldn't Let Them)

#78

Post by claudius »

jarek wrote: post #29
anonymfus wrote: post #19

Earlier quoted context omitted.

Or, for example, attacker stole your backup via vulnerability in your NAS. Or, for example, some idiots share whole system volumes in e2k and Direct Connect networks. Or ever web: https://www.google.ru/search?client=opera&q=intitle:%22index...

Just getting the file would not help you for the attack vectors shown in the article for Chrome (need user account's CryptProtectData), IE-pre-10 (need copy of registry keys + CryptProtectData), or IE 10 (need binary on user account). Firefox would appear to be vulnerable to that approach. Not sure about Opera's wand.dat, probably vulnerable as well.

Opera allows you to set up a master password, if you want it. If you don’t want it, you can copy around wand.dat as you like (even from your computer to your phone!) and it just works. :)

Re: How Browsers Store Your Passwords (and Why You Shouldn't Let Them)

#79

Post by graycat »

jzwinck wrote: post #69
graycat wrote: post #48

Earlier quoted context omitted.

Thanks for your reply. The situation is very common on the Web now. My 17" monitor is from NEC years ago, is razor sharp and rock solid, and I see no great reason to take time out to change from it. Besides, as another comment in this thread noted, laptops also have relatively small screens! So do tablets and phones! I know nothing about using Google's blogspot. For the Web site I'm building, all screens are just 800…

Your web pages with fixed width of 800px may be fairly annoying to users with high-DPI displays. Mac Retina displays are perhaps the most recent and well known, but for years some people have had displays with DPI 50-200% higher than "normal", and for these people, your 800px decision looks like handcuffs. If you look back a dozen years you'll see a number of sites that instituted fixed-pixel-width layouts, then aban…

Thanks.

I don't know what to do about that yet.

If they have a way just to zoom my Web pages, then they will be okay.

But if they have a big screen with lots of pixels, then I don't want my Web pages taking all of that screen. It's better for the UI/UX for my pages to take less than the full screen so that my users can see some other screens while using my site.

Re: How Browsers Store Your Passwords (and Why You Shouldn't Let Them)

#80

Post by jrochkind1 »

emn13 wrote: post #75
jrochkind1 wrote: post #27

Chrome OSX stores in OSX keychain, out of the box. Which is a fairly secure way to store passwords.

In essence, all the browsers do roughly that on all platforms the article mentions.

I don't think that's true.

Firefox, out of the box, does _not_ use the OSX keychain even on OSX. Sadly. It ought to.

Post reply on HN