Comment by robomartin | Hacker News Reader

Comment by robomartin | Hacker News Reader

Bad idea: Chrome is dangerous for the uninformed!

It still has a pretty serious security hole: Passwords are visible in plain text. A quick trip into "Personal Stuff" and "Manage saved passwords..." is all you need in order to expose this info.

I ran a quick test. Without straining much, you can click the "show" button on about 40 passwords in one minute. A quick Ctrl+P and the entire list is printed in plain text! It probably wouldn't take much longer than that to email it or transmit the plain text list via some other method.

If you have three to five minutes on someone's workstation you can walk away with the login information for absolutely everything they've done through the browser, banking, social, email, whatever.

What sucks is that people have been very vocal on the Chrome support forum about this particular issue and, well, they've been summarily ignored.

Maybe I'm missing something fundamental here but I just can't understand why Google would leave this huge gaping hole in there. It can't be that hard to at least provide one more layer of security. You should not be able to see any passwords without a master password.

I've looked at some of the arguments pointing out that this could provide a false sense of security. My point (and that made by countless others) is very simple: The way it works today a ten-year-old could steal all of your passwords inside of five minutes without even having to work very hard. A layer or two of security would make it so that a far more knowledgeable and seriously involved process (or spying software) would have to be utilized to steal your stuff. I vote for option #2.

I use Chrome as my primary browser, but I am not a civil servant at a government office. I am keenly aware of the security hole.

That said, I don't recommend it to family and friends because a non-techie will screw themselves in an instant with this browser. Imagine Uncle Pete taking his laptop to be serviced and having all of his personal login data fully exposed to the 17-year-old pimple-faced kid at the computer shop. Terrible stuff.

Google: Please fix this before it becomes the source of embarrassment and huge personal loss to lots of people.

User access to user settings is not a "security hole". And I don't think there is a way to protect your logged in, unattended session without demolishing productivity. If you walk away from your computer, lock it. I would expect the State Department to have some protections in place (proximity cards, mandated timeout settings, etc) when actual privileged information is concerned and being accessed.

Yes, it would probably be nice if Chrome had the kind of protection of passwords database with a master password that Firefox does. But it still isn't a "security hole".

Also, as has been written before (and in that chrome bug, I believe), it's trivial to hack the Firefox master password if you are at the physical machine, to say nothing of browser history, account cookies, etc that are stored in the clear.

It might be a good UI change, but agreed that it isn't the kind of "security" that the State Department is concerned about.

How is it not a security hole? Does it not expose critical data with ease?

Walking away from an unlocked machine isn't the only scenario that would expose personal login data this way.

Also, my post refers to a more general use of Chrome. I would hope that a government installation might have several layers of security on top of any application in order to prevent these holes from being exploited.

The "Uncle Pete" example is a very real and plausible scenario.

The fact that nearly anything on a computer is hackable isn't the point either. I kind of draw the line at the stage where a precocious ten year old can steal your data while jumping on one foot and whistling the latest Lady Gaga song with one hand tied behind his back and one eye closed.

If that doesn't define a security hole I don't know what would.

As others have pointed out - the problem is not locking your machine when you leave it alone. Suppose that you're using whatever browser that you think does this right, and an adversary gets unencumbered access to the machine because you didn't lock it while you were away. How much protection do you think FireFox or whatever is going to provide relative to the keylogger that is now running on the box?

It's not a slam dunk that Chrome would be better if it had a master password anyway given that rarely used passwords tend to be forgotten quickly, and no one wants Chrome to inflict us with some Vista UAC clone.

Finally, it's extremely annoying to read hyperbolic comments in which the author responds to criticism by redirecting to some irrelevant corner case viz "my post refers to a more general use of Chrome". If that were really the case, then why "the sky is falling" tone in the original post?

With Chrome in "civilian" hands by the millions the sky could very well be falling.

How many pieces of software on a typical computer hold information that, if it got into the wrong hands, could literally ruin somene's life? For the average Internet user the browser is the only answer. I can't understand why it is that it is wrong to demand at least enough access difficulty to frustrate a smart ten year old.

Here's the other problem: Google, as far as I know, does not make the user aware of the potential exposure. This can't be good.

There is: KeyChain on OS X does this correctly by encrypting the file and asking for your account password when you want to view a saved password.

It might not be 100% hacker safe, but it is 100% employee safe at my workplace, which makes a world of difference.

Right, and the whole office scenario is even scarier than the "Uncle Pete at the computer shop" scenario. In non-techie offices --say, the doctor's office, dentist, the local real-estate shop, whatever-- people don't have a clue about security. And, they have even less of a clue about Chrome being so dangerous. Imagine everyone going out for lunch and leaving their computers unattended (and unlocked).

Given that scenario, someone up to no good who stays behind with the express purpose of stealing personal data can have a treasure trove of information by the time everyone is back. And --again, this is my biggest point-- they don't have to be a hacker to do this. All they have to do is point and click and they got everyone's data (and the businesses data as well).

It's about time that Google fix this so that it actually requires some skill and effort to steal your data.

This is also one of the reasons none of my notebooks have Chrome. Imagine loosing it or having it stolen.

I believe Chrome does use Keychain on OS X. The problem is people click the "always allow" access button the first time Chrome tries to access an already stored password, they enter their password, and then the user isn't prompted anymore. Your passwords are safe and encrypted...Chrome can just display them when it's open because it has access, as the user instructed.

Yes it is if you lose a laptop on a train or in a taxi your fucked - chrome still exposes passwords en clair FS amateur night or what.

Of course unless you want to play the oldest trick in the book the "lost despatches trick" (see operation mincemeat for a ww2 example) it might be an advatage :-)

Adding a master password would be fairly trivial, but we specifically chose not to because it endangers users by creating false sense of security. Anyone with access to your account can trivially get at your saved passwords in any browser. Hiding this fact only encourages careless behavior on the part of users, who will naively assume it's unnecessary to lock the machine.

Simply put, if you let someone have unrestricted access to your account, then it's not your account anymore. There's nothing the browser can do to change that. If you need further clarification, I encourage you to read through the bugs filed for this request:

http://code.google.com/p/chromium/issues/detail?id=53 http://code.google.com/p/chromium/issues/detail?id=1397 http://code.google.com/p/chromium/issues/detail?id=92117

I think this is part of a class of problems that delegate th responsibility of protecting data to the user. I find myself facing similar issues with my wifi for instance. In Ubuntu, showing your wifi password is also trivial and it does not prompt for a master password. that 17 kid will have uncle pete's data and free wifi.

I agree with you but there's probably a big difference between your typical Linux user and "Uncle Pete" caricature.

Up until browsers it is unlikely that a single piece of software on millions of computers held the keys to someone's entire personal and financial life. Sure, some --few-- people might have kept that data in unencrypted text files, but it is probably fair that this was ver, very rare.

Today millions store access data to everything they do on the net, from financial to social, in their browsers.

Is it too much to ask that browser makers take the stuff seriously and give the user the option to protect this data?

Give the techies the option to turn it off if they wish. For uncle Pete it should be turned on by default.

I dont see how your approach will solve problem. If anything, it will further alienate normal users and portray the solution as requiring a minimum level of geekness.

That has been disabled in their build. As have various other things such as incognito window, autofill, sign in, extensions...

I'd appreciate explanations for down-voting. I don't think the downvote is fair. Is any of what I said factually incorrect? How?

HN can be really weird sometimes.

Reply on news.ycombinator.com