Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Chrome security flaw offers unrestricted password access

theguardian.com

Post reply on HN
Print view View original

71–80 of 95 posts

Re: Google Chrome security flaw offers unrestricted password access

#71

Post by EliAndrewC »

tptacek wrote: post #49
joekrill wrote: post #40

Earlier quoted context omitted.

I absolutely agree. Although Firefox at least gives you the ability to set a master password to add additional security. Chrome does not.

They deliberately do not, because that password doesn't solve any security problems, but does communicate to users that Chrome is doing something to protect their account that it doesn't and can't do. Firefox should lose the feature.

Can you clarify why the master password isn't offering any protection? It encrypts your other passwords so that they are not stored in plaintext on the filesystem; this alone seems like it's offering a little security, since my (perhaps mistaken) assumption is that it's more likely for someone to be able to read a file on your filesystem than to read in-memory passwords stored in RAM.

EDIT: Your other comment at https://news.ycombinator.com/item?id=6173111 probably explains your view on this; that there are few attacks in practice which would be thwarted by encrypting passwords at rest, and that the false sense of security on the part of the user would be disproportionately high.

Re: Google Chrome security flaw offers unrestricted password access

#72

Post by astalwick »

tptacek wrote: post #70
astalwick wrote: post #69

Earlier quoted context omitted.

Degree of difficulty matters. The technical ability of the attacker matters . With this feature, it's trivial for absolutely anyone to steal my secrets in seconds. Without this feature, the time-to-compromise goes up, as does the technical knowledge required. The degree-of-difficulty (which, yes, is still low), goes up. It is cosmetic, but INTERFACE MATTERS. If you don't want people doing something, don't have a feat…

Yes, degree of difficulty matters. We don't disagree on that. It's the fundamental rule of security. What we disagree on is the specific degree in this case. You think it's significant. I know it's not. Chrome's security design is denominated in thousands of dollars. This is a penny feature, and one with potential liabilities; it could cost more than it benefits.

With the feature, I can explain to my mom, my girlfriend, my sister how to steal passwords from any chrome browser. In a way that they will remember and be able to repeat tomorrow.

Without it, I can't.

That matters.

Re: Google Chrome security flaw offers unrestricted password access

#73

Post by tptacek »

astalwick wrote: post #72
tptacek wrote: post #70

Earlier quoted context omitted.

Yes, degree of difficulty matters. We don't disagree on that. It's the fundamental rule of security. What we disagree on is the specific degree in this case. You think it's significant. I know it's not. Chrome's security design is denominated in thousands of dollars. This is a penny feature, and one with potential liabilities; it could cost more than it benefits.

With the feature, I can explain to my mom, my girlfriend, my sister how to steal passwords from any chrome browser. In a way that they will remember and be able to repeat tomorrow. Without it, I can't. That matters.

I am not interested in security features that work only against my mom, and you shouldn't be interested in them either.

Re: Google Chrome security flaw offers unrestricted password access

#74

Post by shinigami »

teaneedz wrote: post #63
shinigami wrote: post #57

Earlier quoted context omitted.

You bypass a password manager the same way you bypass Chrome. Just open it. If someone left the PC unlocked, there is a good chance the password manager is unlocked too.

As far as I'm used too, you have to enter a password still for a PW manager.

There is a timeout. Some people configure it to lock only when you lock the workspace.

If the suggestion is to lock immediatly after you use a password, then people will complain that it's too cubersome to enter the master password everytime you need to enter a password.

Re: Google Chrome security flaw offers unrestricted password access

#75

Post by astalwick »

tptacek wrote: post #73
astalwick wrote: post #72

Earlier quoted context omitted.

With the feature, I can explain to my mom, my girlfriend, my sister how to steal passwords from any chrome browser. In a way that they will remember and be able to repeat tomorrow. Without it, I can't. That matters.

I am not interested in security features that work only against my mom, and you shouldn't be interested in them either.

So, but, really: I am interested, as are a lot of other people. Hence the gnashing of teeth.

I'm not thrilled by the security community's black-and-white stance that if it can't stop a defcon attendee, then it's not real security and it's not worth doing.

If my mom can be stopped, and it's simple to stop her, then I really don't get the resistance. 'False sense of security'? Yeah, that ship has already sailed. That's why the Guardian is writing articles like this - people are surprised to learn HOW trivial it is to steal passwords in chrome.

Re: Google Chrome security flaw offers unrestricted password access

#76

Post by tptacek »

astalwick wrote: post #75
tptacek wrote: post #73

Earlier quoted context omitted.

I am not interested in security features that work only against my mom, and you shouldn't be interested in them either.

So, but, really: I am interested, as are a lot of other people. Hence the gnashing of teeth. I'm not thrilled by the security community's black-and-white stance that if it can't stop a defcon attendee, then it's not real security and it's not worth doing. If my mom can be stopped, and it's simple to stop her, then I really don't get the resistance. 'False sense of security'? Yeah, that ship has already sailed. That's…

You make it sound like that stance is elitist, but it's the opposite: it's our knowledge of how easy it is to get the level of "Defcon Attendee" that motivates us not to implement cosmetic security features.

Re: Google Chrome security flaw offers unrestricted password access

#77

Post by Karunamon »

lawnchair_larry wrote: post #36

It amazes me that some of the security professionals are sufficiently out of touch that they don't see this as an issue. The adversary in this case is the casual non-technical observer who might have a minute to click around but not install software to extract anything, it is not "hackers".

The adversary that can be trivially defeated by entering Meta+L before walking away from your desk, or by not allowing untrusted randoms around your console?

Re: Google Chrome security flaw offers unrestricted password access

#78

Post by astalwick »

tptacek wrote: post #76
astalwick wrote: post #75

Earlier quoted context omitted.

So, but, really: I am interested, as are a lot of other people. Hence the gnashing of teeth. I'm not thrilled by the security community's black-and-white stance that if it can't stop a defcon attendee, then it's not real security and it's not worth doing. If my mom can be stopped, and it's simple to stop her, then I really don't get the resistance. 'False sense of security'? Yeah, that ship has already sailed. That's…

You make it sound like that stance is elitist, but it's the opposite: it's our knowledge of how easy it is to get the level of "Defcon Attendee" that motivates us not to implement cosmetic security features.

But it's not. Not THAT easy. I'm a developer, with a fair bit of experience, and I'm nowhere near the average defcon attendee. (Unless I'm badly overestimating their abilities).

My mom? She asked a shop owner, two days ago, 'do you have a, uh, online thing? You know, with the pictures?'

And yet, "Mom, experiment: type 'chrome://settings/passwords' in my browser and see how many passwords you can steal in 60 seconds".

Re: Google Chrome security flaw offers unrestricted password access

#79

Post by tptacek »

astalwick wrote: post #78
tptacek wrote: post #76

Earlier quoted context omitted.

You make it sound like that stance is elitist, but it's the opposite: it's our knowledge of how easy it is to get the level of "Defcon Attendee" that motivates us not to implement cosmetic security features.

But it's not. Not THAT easy. I'm a developer, with a fair bit of experience, and I'm nowhere near the average defcon attendee. (Unless I'm badly overestimating their abilities). My mom? She asked a shop owner, two days ago, 'do you have a, uh, online thing? You know, with the pictures?' And yet, "Mom, experiment: type 'chrome://settings/passwords' in my browser and see how many passwords you can steal in 60 seconds".

You are badly overestimating their abilities, for instance by assuming that the typical Defcon attendee can code. We're talking past each other. Just take my word for it that bypassing the proposed "master password" is even easier than I've managed to make it sound.

Re: Google Chrome security flaw offers unrestricted password access

#80

Post by interpol_p »

Arzh wrote: post #54
interpol_p wrote: post #52

Earlier quoted context omitted.

It does work . Security is about far more than preventing determined, malicious attackers. It is also about being able to use your computer in a work or family environment with a reasonable expectation that your privacy will be maintained without explicit effort on your part. You call them "attackers" but that is not who we are discussing. We are talking about people being able to casually browse your saved passwords…

Because no matter what, you can just go to the website and be logged in automatically. Once you let someone else use your computer you are no longer secure. This is why if you have multiple people using the same computer, you set it up to have multiple users. Once they are using YOUR instance of chrome it doesn't matter, they have everything.

There's a significant difference in the intent required between browsing someone's password settings and actually attacking their computer. This is important.

I'm not discussing malicious attackers, I'm not even discussing someone who is out to get your password. Chrome makes it possible, in seconds, for someone to reveal your passwords as a crime of opportunity.

Post reply on HN