Browsers keep password in memory, how serious is that?
1–7 of 7 posts
Re: Browsers keep password in memory, how serious is that?
#2Since I'm a windows user, it's pretty concerning for me. Many [rather vague] processes need administrative permissions in order to run. Now with the fact that nearly all my passwords are saved in clear text in memory and can be accessed by other programs, it can be scary to think what others can do with the passwords which are not 2FA.
Re: Browsers keep password in memory, how serious is that?
#3Since I'm a windows user, it's pretty concerning for me. Many [rather vague] processes need administrative permissions in order to run. Now with the fact that nearly all my passwords are saved in clear text in memory and can be accessed by other programs, it can be scary to think what others can do with the passwords which are not 2FA.
>Extracting can be done from any non-elevated process that runs on the same machine
It doesn't even need elevation...!
Re: Browsers keep password in memory, how serious is that?
#4This is a total nothingburger. If malware has enough access to steal passwords from your browser's memory, then there's no way to stop it from getting them.
Re: Browsers keep password in memory, how serious is that?
#5This is a total nothingburger. If malware has enough access to steal passwords from your browser's memory, then there's no way to stop it from getting them.
Exactly my thoughts. This becomes whack-a-mole since I must at some stage get the password in clear text what method do I use to keep them secure. Whatever it is it's just going to be obfuscation I the end.
Re: Browsers keep password in memory, how serious is that?
#6This is a total nothingburger. If malware has enough access to steal passwords from your browser's memory, then there's no way to stop it from getting them.
The article says that there is no need for elevation (I'm not sure it's true though)...
Re: Browsers keep password in memory, how serious is that?
#7This is a total nothingburger. If malware has enough access to steal passwords from your browser's memory, then there's no way to stop it from getting them.
The article says that there is no need for elevation (I'm not sure it's true though)...
So? Why should you need elevation to interact with your own non-elevated processes?