Hacker News Reader

Comment by ylk | Hacker News Reader

For reference, this is how Google says Chrome stores passwords encrypted in memory and uses an elevated service to prevent other processes from impersonating Chrome and gaining access to the plain text passwords: https://security.googleblog.com/2024/07/improving-security-o...

View on HN

That appears to be storage at rest (on disk), rather than in memory.

You're correct, thank you. Sadly I can't edit my comment anymore. Sorry for the confusion.

I recall chrome used to let you reveal passwords with a simple button press in the UI. I think their conclusion at the time was if an attacker had local access there was no point in pretending they were hidden.

I still found it insane to display passwords that easily. Sometimes I give brief access to my PC to friends, family, acquaintances, or even colleagues, and they shouldn't be able to see my passwords with a simple button. It's like leaving your bike out unlocked, because someone with the right tools can break the locks anyway.

I think it makes perfect sense. I want to see my passwords without having to re-enter my system password every time.

Operating systems have had guest accounts for decades for the "handing your PC to friends/family/etc." use case. Even Android phones have temporary guest accounts (though many manufacturers disable that because it interferes with their own secondary user-based hacks).

Guest accounts are a nice theory that do not match the lived practice of scenarios such as "Yeah sure, go to the PC to add some songs to the playlist".

> It's like leaving your bike out unlocked, because someone with the right tools can break the locks anyway.

Not to strain the analogy, but it's more like not locking your bike when it's in your locked apartment (the apartment being your computer). The thought being that if someone puts the time and effort into breaking into your apartment, a bike lock isn't going to do anything to stop them.

Reply on news.ycombinator.com