Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Browsers Store Your Passwords (and Why You Shouldn't Let Them)

raidersec.blogspot.in

Post reply on HN
Print view View original

81–82 of 82 posts

Re: How Browsers Store Your Passwords (and Why You Shouldn't Let Them)

#81

Post by jrochkind1 »

UnoriginalGuy wrote: post #31
jrochkind1 wrote: post #27

Chrome OSX stores in OSX keychain, out of the box. Which is a fairly secure way to store passwords.

Let's assume for the sake of argument that we are running code on both a Windows machine and an OS X machine, and trying to steal someone's browser passwords. While it is undeniable that the OSX keychain adds a roadblock to the theft, many average users would happily enter their password if the box was displayed when they ran up their browser (even if the browser wasn't the originating process) and likely also fall f…

You're mostly talking about what's basically a phishing attack, right?

I'm not really sure there is really any defense yet devised for phishing attacks against 'average non-power users.'

I'm not disputing you though, I think it is a problem. But unrelated to how securely a given app stores sensitive info, which is what OP is about.

Re: How Browsers Store Your Passwords (and Why You Shouldn't Let Them)

#82

Post by acdha »

emn13 wrote: post #74
acdha wrote: post #39

Earlier quoted context omitted.

For the attack mentioned above, only one of those is actually useful. Certificates are a complete distraction from what you really need – some sort of multi-factor authentication.

Certificates (I'm assuming assymetric encryption) are better than passwords in that they aren't passed on to the receiving site. This means that sites can build databases of public keys rather than passwords, and that an attacker compromising such a site, rather than getting a password file that he can reuse all over the place, only gets a fairly useless public key which would let him identify the user. And of course…

Certificates make no difference in the threat scenario we were discussing: if I have enough access to your computer to pilfer passwords, I can snag your certificates at the same time.
Post reply on HN