Hacker News Reader

Comment by nobbitthehobbit | Hacker News Reader

What do you think it should do instead?

There is no way for it to encrypt the passwords without having to ask you to enter a master password each time it starts.

You could argue that it shouldn't let you see them through the user interface, but I would argue that this would be useless - security through obscurity.

View on HN

I have no background at all in IT security, but I thought the passwords would be encrypted using a RSA system (the public key would be used to encrypt the password, the private key would be used to read them). The private key would be generated randomly when the browser is built, making it unique, and inaccessible (unless maybe with a debugger, but that's not something that could be done in couple of minutes).

Maybe what I just said is stupid and not feasible, in which case I'd be curious to know why.

I agree with this. The entire promise of password auto-save is to save the user TIME. If the browser locked itself every couple of minutes and asked for a master password between visits, it would not help the user save TIME.

I think the author is confusing a feature exclusively created for convenience with one that would be targeting security exclusively.

PS: However, what better way to get HN traffic than a sensational title like that...

it could for example use the system keychain on MacOS and not expose an interface. Chrome could then read the passwords from the keychain, but any user-access to the password would have to go through "keychain access" and require the users logon password to show in plain. Storage would also be encrypted, so it wouldn't be "security through obscurity" but rather a real step towards protected password storage.

Reply on news.ycombinator.com