Hacker News Reader

Comment by madaxe | Hacker News Reader

I can see you don't, which is why I'm trying to pose it variously.

It's a simple one: why make it easier for a user to be compromised than is necessary? Why is it such a problem to ask the user to enter their account password before viewing this prefpane? You've not provided a valid argument against this.

As to lulling users - they already are. All of your marketing screams about how secure chrome is, how you don't need to worry about security, and all the rest, so showing their plaintext passwords just seems... silly.

View on HN

> Why is it such a problem to ask the user to enter their account password before viewing this prefpane?

You're trying to prevent my friends from fetching my email password to look secretly at my self-nude pictures.

Justin is trying to prevent my enemies from fetching my email password to gain access to my bank account and rob me of all my money.

His point is Chrome preventing the former threat, while useful by itself, can lead me to believe that I'm also protected against enemies with physical access. This belief, as we know, makes preventing the latter threat impossible. As he cares way more about the latter threat, he thinks it's counterproductive to defend against the former.

> All of your marketing screams about how secure chrome is

To be fair, that refers to being secure against remote attackers, which is the primary concern of a browser since there's not much the user can do about it by himself.

Yeah but his point is really silly. He's trying to make the argument that by making it impossible to lock the car we won't leave valuables in it.

His argument is that since a person could just smash the windows and open the car that way there's no point in putting locks on the door.

It's just a very myopic and weirdly out of touch position. He seems to think that he's 'training' users to have more secure practices? This isn't the business world. You don't get to blame the user for not being security experts. He should be doing everything in his power to make it inconvenient and difficult to access a user's passwords.

> Why is it such a problem to ask the user to enter their account password before viewing this prefpane? You've not provided a valid argument against this.

Most users do not have to enter their password when their OS boots, and thus won't know what it is. So offering it in Chrome is an inconvenience for most users, but adds no extra security. Once an attacker has physical access and can run Chrome browser it's game over and they can get everything, even if Chrome asks for a password before showing you the password pane.

Users should be setting up "guest" accounts for their OS and "Guest" user profiles for their web browsers.

Again, missing the point. Both your average attacker and average user have as much technical knowledge as a daffodil, which means even the most trivial barrier would be effective.

As to users who don't set a password - never make the passwords visible.

In that case the most trivial barrier is to lock the screen when you're away from your machine, or to set a guest account for when you lend the machine to someone else.

what makes you think that people that hate to remember passwords will want to remember a password that locks them out of their password? This is stupid. Users that care about security will LEARN about more secure solutions one way or another. Don't treat humans as dumb fucks.

Reply on news.ycombinator.com