Hacker News Reader

Comment by andreasley | Hacker News Reader

This reminds me of the fact that Firefox, by default, allows anyone to view stored credentials – no authentication required, as no master password is set. It boggles my mind.

View on HN

I was fairly sure that firefox is using your OS keyring. IE, it is encrypted at rest.

You logging into your computer unlocks your keyring, which unlocks the secret your browser uses to encrypt things like passwords....

However looking at my keyring on Linux, I see secrets for Chrome, I do not see secrets for firefox... Which I find extremely surprising and disappointing...

If you're logged in then it's on par with just about everything else.

If you're not logged in, and you don't encrypt your files, then someone getting access to saved passwords in addition to all your files is worse than just getting access to all your files, but not by a huge amount.

If you're not logged in and do encrypt your files then nobody will have access.

So does Chrome, Edge, and GNOME Web. Safari locks it behind a password prompt, but they can still be extracted one-by-one by using devtools to inspect the value of the password field after being autofilled.

Chrome and derivates require the user's account password to view the stored passwords. Safari uses the macOS keychain and won't show passwords easily. The trick you mentioned only works on Macs without Touch ID and requires more work, so not really the same.

Firefox at least gives you the option of a master password. Chrome from what I recall has consistently refused to have a master password (on Windows at least).

Chrome on Windows uses your user passwords when viewing.

And kwallet/gnome-keyring on Linux. Firefox does not.

I recall this story:

https://www.theguardian.com/technology/2013/aug/07/google-ch...

Chrome does they same, at least on windows, if you merely have local admin on the box.

"if you merely have local admin", yeah the game was lost when you signed on to that machine the first time not when it didn't ask your personal password the Nth time.

Reply on news.ycombinator.com