Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft Edge stores all passwords in memory in clear text, even when unused

twitter.com

Post reply on HN
Print view View original

91–100 of 243 posts

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#91

Post by dist-epoch »

Someone1234 wrote: post #16
WolfeReader wrote: post #9

Please use a dedicated password manager, instead of a browser-based one. KeePass is likely the best going forward.

If it is a process, running in the same user context, with the ability to read/dump arbitrary memory -- As the KeePass database is decrypted it would "store all passwords in memory in plain text" too. The fix isn't Edge Vs. Chrome. Vs KeePass Vs. Bitwarden, it is "How do I have my passwords exist in a different execution context than [evil process able to read all memory]?" Android and iOS have an "answer" to this pr…

Windows already has a secure kernel credential store, they could move the Edge password store there with a bit of effort, minimize the splash damage when you retrieve a single password to send over HTTP from the regular user space.

> Credential Guard prevents credential theft attacks by protecting NTLM password hashes, Kerberos Ticket Granting Tickets (TGTs), and credentials stored by applications as domain credentials.

> Credential Guard uses Virtualization-based security (VBS) to isolate secrets so that only privileged system software can access them.

https://learn.microsoft.com/en-us/windows/security/identity-...

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#92

Post by slow_typist »

gruez wrote: post #4

This feels like a case of "It rather involved being on the other side of this airtight hatchway"[1]. If you can read arbitrary process memory, you're probably also in a position to just dump out the passwords by pretending to be the user in question. > If an attacker gains administrative access on a terminal server, they can access the memory of all logged‑on user processes. If an attacker has administrative access,…

All true, but it is still bad style. There is no need to keep decrypted passwords in memory the user hasn’t even used in the session (or after they logged in to a certain website).

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#93

Post by justsomehnguy »

75central wrote: post #10
WolfeReader wrote: post #9

Please use a dedicated password manager, instead of a browser-based one. KeePass is likely the best going forward.

Out of curiosity, why KeePass versus Bitwarden? I've been using Bitwarden for years, but if there's a specific reason I should be using KeePass instead, I'm open to changing.

It's a program with a file database.

No fancy browser plugins, the ability to autotype, the db file could be synced with anything you can sync files.

Working search - not sure about BW, but it's opensource implementation (Vaultwarden nowadays?) simply didn't allow to search for the fields you didn't scroll yet to.

The biggest problem is lack of multi-edit functionality - you need keep it in mind if you leave somehwere a copy running 24/7.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#94

Post by Someone1234 »

dvt wrote: post #59
Someone1234 wrote: post #52

Earlier quoted context omitted.

This is accurate as far as page protection goes. The problem is the largest threat model. If Process A and Process B are running in the same user context on a desktop OS, PAGE_NOACCESS is not a strong boundary by itself. Process B may be able to obtain PROCESS_VM_OPERATION/PROCESS_VM_READ, change the page protection with VirtualProtectEx, inject code that calls VirtualProtect inside Process A, load a DLL, attach as a…

This comment feels like it's written by AI. Anyway, PAGE_GUARD helps you get around VirtualProtectEx, which is a very common way of detecting userspace cheats.

> This comment feels like it's written by AI.

Why exactly? I'm genuinely asking, because I feel like I get this a lot, and it is pretty frustrating.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#95

Post by StilesCrisis »

jonathanlydall wrote: post #90
StilesCrisis wrote: post #79

Earlier quoted context omitted.

Never enter your password into a website that doesn't use https.

*over any untrustworthy network. To fair though, there are very few situations where the network is completely trustworthy, like your home network with no one else on it or a VPN direct to an HTTP server.

My understanding was that if you have a valid https session, you are good.

A really really untrustworthy network could MITM your SSL connections and impose itself in front of all of them (Cisco IronPort?) but I think even then your browser will complain unless you've installed a proxy that allows it or a custom root certificate.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#96

Post by ylk »

munk-a wrote: post #81
riedel wrote: post #14

Earlier quoted context omitted.

Password managers often go through quite some hassle to keep passwords 'safe' in memory. However, I often do not get the attack model of many of those tools. Tools like keepass e.g. go through quite to register a browser plugin. But then anyone with normal user rights can extract that key from the browser and do everything with it. Also this whole 'trust this browser' stuff of web apps seems strange if one e.g. can r…

Cookies, if done correctly, will store a string that the server offered after a successful authentication - that string should have nothing to do with the password (it might contain some user information for logging/cross site tracking) but nothing sensitive. With said cookie you can absolutely impersonate a user for while (potentially needing to evade user agent string checks and the like but often not)... but it wi…

There are (illegal) marketplaces initial access brokers sell session cookies on. Some companies try to defend against that by e.g. checking whether it's even possible that you travelled from place A to place B within a certain timeframe and, based on that, might invalidate your cookie. But then again attackers, depending on their sophistication, find their ways around it by ensuring they proxy their traffic via geographically close residential proxies, use the same OS and browser versions, etc.

Google now wants to bind credentials to a device by storing the secret in the TPM: https://blog.google/security/protecting-cookies-with-device-...

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#97

Post by dlcarrier »

alterom wrote: post #71
timedude wrote: post #63

That's kinda stupid. The passwords could get swapped to disk in the swap file in plaintext when memory is low by the OS.

You say this as if accessing that file was any easier than accessing memory.

It is when the computer is off.

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#98

Post by Sohcahtoa82 »

Someone1234 wrote: post #35
busterarm wrote: post #13

For anyone that thinks this is an Edge-specific dunk, Chrome does not hash your passwords and they are cleartext in memory while Chrome is running (which for most users is always).

Password hashes are one-directional lossy storage. If a password manager "hashed your password" it would be essentially deleting your password and replacing it with something else which cannot be used to log into anything. The password MUST be recoverable to plain-text to replay it to a website. But you're correct that Chrome, Firefox, Edge, Lastpass, BitWarden, even Keepass have the same issue. It is an Operating Sy…

I think the catch is whether the passwords are unencrypted in memory constantly, or only during a short period when the password is being used?

Re: Microsoft Edge stores all passwords in memory in clear text, even when unused

#100

Post by BalinKing »

Someone1234 wrote: post #94
dvt wrote: post #59

Earlier quoted context omitted.

This comment feels like it's written by AI. Anyway, PAGE_GUARD helps you get around VirtualProtectEx, which is a very common way of detecting userspace cheats.

> This comment feels like it's written by AI. Why exactly? I'm genuinely asking, because I feel like I get this a lot , and it is pretty frustrating.

I'm not the other commenter (and I believe you that it's not AI), but I'd guess it's mostly the first line: a short affirmation followed by "The problem is ...." feels like the sort of formula the LLMs love to use. (Not trying to imply that there's anything inherently wrong with it, of course.)

While we're at it, I'm under the impression that the recent LLMs have also co-opted "genuinely", which I'll never forgive them for—first they stole my em-dashes, and now they're stealing my adverbs too?!

Post reply on HN