Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft Edge stores all passwords in memory in clear text, even when unused

twitter.com

Post reply on HN
Print view View original

81–90 of 243 posts

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#81

Post by munk-a »

riedel wrote: post #14
kleiba2 wrote: post #5

Does this tool access an Edge instance running on the same machine? Couldn't you then just simply export all saved passwords anyway? https://support.microsoft.com/en-us/topic/export-passwords-i...

Password managers often go through quite some hassle to keep passwords 'safe' in memory. However, I often do not get the attack model of many of those tools. Tools like keepass e.g. go through quite to register a browser plugin. But then anyone with normal user rights can extract that key from the browser and do everything with it. Also this whole 'trust this browser' stuff of web apps seems strange if one e.g. can r…

Cookies, if done correctly, will store a string that the server offered after a successful authentication - that string should have nothing to do with the password (it might contain some user information for logging/cross site tracking) but nothing sensitive.

With said cookie you can absolutely impersonate a user for while (potentially needing to evade user agent string checks and the like but often not)... but it will expire and then your access should be ended. If the site is well designed actions like password changing should also re-require the user's password instead of allowing anyone with just the cookie from proceeding with the action.

If it is done right cookies are pretty decently secure at keeping your secrets safe but, for convenience they do lower the security that could be accomplished with more involved techniques.

As an aside Oauth's key -> token approach is basically identical to password -> cookie (assuming best practices are in place).

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#82

Post by cachius »

RajT88 wrote: post #53
turtlebits wrote: post #12

Earlier quoted context omitted.

Security isn't black and white. If i leave a post-it note of my logins on my monitor, that's definitely less safe than in a unlocked drawer, and so on.

The way to think about security is as a system of layers, each of which filters out ever more sophisticated attackers. We should care about all kinds of attackers, and not assume that the protections against the most sophisticated will obviate the protections against the least sophisticated.

The Swiss cheese model. Each single layer has holes, but when stacked the combined hole area is minimized https://en.wikipedia.org/wiki/Swiss_cheese_model

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#83

Post by dist-epoch »

mintplant wrote: post #72
alterom wrote: post #71

Earlier quoted context omitted.

You say this as if accessing that file was any easier than accessing memory.

If I have a disk image or access to the physical drive, it's trivial. This means they can no longer be considered encrypted at rest.

If your computer storage is not fully encrypted you have bigger worries than the swap file.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#84

Post by munk-a »

mintplant wrote: post #72
alterom wrote: post #71

Earlier quoted context omitted.

You say this as if accessing that file was any easier than accessing memory.

If I have a disk image or access to the physical drive, it's trivial. This means they can no longer be considered encrypted at rest.

If you're on prem or able to manipulate the machine into an OS of your choosing, yes. But with purely remote access to a device the disk is pretty decently secured (even if Window's ACLs are nightmareishly convoluted).

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#85

Post by slau »

alterom wrote: post #70
Someone1234 wrote: post #57

Earlier quoted context omitted.

True. But then your hardware dies, and you're locked out of every account you own. It is objectively good security, but has a ton of usability headaches yet to be really solved. I've seen orgs move to passkeys only, then offer reset-questions (e.g. city of first job, etc); because the Customer Service volume/workflow wasn't figured out.

>your hardware dies Or your backpack gets stolen. Oops. I swear, people who idolize passkey security must never travel anywhere. PS: "just have more devices with passkeys", they invariably say. Yeah right because people are made of money, everyone has the forethought, and a 2nd laptop in the US is a great asset when you're in Poland and can't login anywhere.

I travel a lot. By train, plane, and car. I also use passkeys when possible. I have multiple Yubikeys, stored in different locations. I also have a password manager, where I typically keep track of which logins aren’t yet backed up across physical tokens.

It takes a bit of effort, but it’s not impossible.

Yes, it means that in the event of catastrophic failure I might not be able to log in to some services until I get to one of the backups. I haven’t been able to imagine a scenario where that would be truly problematic.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#86

Post by ButlerianJihad »

cachius wrote: post #82
RajT88 wrote: post #53

Earlier quoted context omitted.

The way to think about security is as a system of layers, each of which filters out ever more sophisticated attackers. We should care about all kinds of attackers, and not assume that the protections against the most sophisticated will obviate the protections against the least sophisticated.

The Swiss cheese model. Each single layer has holes, but when stacked the combined hole area is minimized https://en.wikipedia.org/wiki/Swiss_cheese_model

That was an enlightening read, considering the colloquial meaning of "your firewall security is like Swiss cheese"

https://en.wiktionary.org/wiki/Swiss_cheese#Noun

What's next? A system so secure that you can drive a truck through it? A honeypot in the center of a wasp nest?

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#87

Post by dist-epoch »

bobbiechen wrote: post #25
busterarm wrote: post #13

For anyone that thinks this is an Edge-specific dunk, Chrome does not hash your passwords and they are cleartext in memory while Chrome is running (which for most users is always).

This is generally true of every application that handles sensitive data. Unless you explicitly clear that memory, it's likely to hang around forever. For example, here is a 2019 writeup from KeePassXC with similar notes: https://keepassxc.org/blog/2019-02-21-memory-security/ - even though they explicitly clear sensitive data, there is still a window of opportunity. During my time working on confidential computing, we…

Windows already has a secure kernel credential store, they could move the Edge password store there with a bit of effort, minimize the splash damage when you retrieve a single password to send over HTTP from the regular user space.

> Credential Guard prevents credential theft attacks by protecting NTLM password hashes, Kerberos Ticket Granting Tickets (TGTs), and credentials stored by applications as domain credentials.

> Credential Guard uses Virtualization-based security (VBS) to isolate secrets so that only privileged system software can access them.

https://learn.microsoft.com/en-us/windows/security/identity-...

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#88

Post by Lorkki »

gruez wrote: post #4

This feels like a case of "It rather involved being on the other side of this airtight hatchway"[1]. If you can read arbitrary process memory, you're probably also in a position to just dump out the passwords by pretending to be the user in question. > If an attacker gains administrative access on a terminal server, they can access the memory of all logged‑on user processes. If an attacker has administrative access,…

In recent years we've also had browser-exploitable vulnerabilities that allowed reading arbitrary memory as a regular user, but slowly or without full control over the locations. I think wiping credentials as soon as possible after use is a very sensible precaution, even if it's only a moat.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#89

Post by slow_typist »

cachius wrote: post #82
RajT88 wrote: post #53

Earlier quoted context omitted.

The way to think about security is as a system of layers, each of which filters out ever more sophisticated attackers. We should care about all kinds of attackers, and not assume that the protections against the most sophisticated will obviate the protections against the least sophisticated.

The Swiss cheese model. Each single layer has holes, but when stacked the combined hole area is minimized https://en.wikipedia.org/wiki/Swiss_cheese_model

The Swiss cheese model is what people use to sell you more 'security' related software systems that inherently involve more problems. (Also cheese is not very durable, even the kind without holes.)

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#90

Post by jonathanlydall »

StilesCrisis wrote: post #79
jazzyjackson wrote: post #65

Earlier quoted context omitted.

especially when the point of a password manager is to stick a plaintext string into a webpage, which then transmits the plain text to a remote server. passwords are just not a very good solution to keeping secrets.

Never enter your password into a website that doesn't use https.

*over any untrustworthy network.

To fair though, there are very few situations where the network is completely trustworthy, like your home network with no one else on it or a VPN direct to an HTTP server.

Post reply on HN