Google Chrome security flaw offers unrestricted password access
theguardian.com
theguardian.com
And please explain how to bypass Safari password manager, or 1Password, or any password manager with a master password, if you believe it's only a cosmetic feature.
https://news.ycombinator.com/item?id=6166731
- dump all your session cookies
- grab your history
- install malicious extension to intercept all your browsing activity
- install OS user account level monitoring software
The last one could plausibly work, in combination with "grab a copy of the encrypted 1Password key file", to compromise all the 1Password stuff. The others essentially work around 1Password, or so I believe.
This is why there are certain passwords that I don't even store in 1Password. It's also an argument for two-factor auth.
If the suggestion is to lock immediatly after you use a password, then people will complain that it's too cubersome to enter the master password everytime you need to enter a password.
This is a big deal because it makes reading passwords easy to do in seconds, and easy to do inconspicuously.
If you were to modify the DOM to unmask passwords it would take longer, and it's not something you can do while a co-worker or friend lends you their laptop for a minute. This flaw presents additional opportunity to anyone who wants to read another person's passwords.
It is not merely "cosmetic." It actually presents a real problem for anyone who does not logout of their account every time someone else uses their computer. Sure, this is probably best practice — but it is also insulting, inconvenient and an unrealistic expectation.
If I have unrestricted access to your machine, your passwords are compromised. Fine. But this is not a common or realistic scenario. It is far more likely I am using your machine with you, and then you walk out for 20 seconds to get a glass of water.
javascript:var a=document.querySelectorAll("input[type='password']");for(var i=a.length-1;i>=0;i--){a[i].type="text"}void 0There is also a significant difference in feeling between the two methods. Your suggestion requires far more intent than visiting the settings page. This is important.
We are not talking about defending yourself from a malicious attacker, we are talking about the moments when you pass your computer to a friend so they can look something up. They can now look up your passwords conveniently and without feeling too bad about it.
Yes, this is cosmetic and anyone with sufficient technical knowledge can still get the passwords without the chrome:settings page, but this feature widens the pool of capable attackers to absolutely everyone.
With this feature, it's trivial for absolutely anyone to steal my secrets in seconds.
Without this feature, the time-to-compromise goes up, as does the technical knowledge required. The degree-of-difficulty (which, yes, is still low), goes up.
It is cosmetic, but INTERFACE MATTERS. If you don't want people doing something, don't have a feature that makes it trivially easy.
Hell, if chrome devs really aren't going to do anything at all about this, then a better solution here would be to bring the button to the FRONT of the interface. 'View All Passwords', right beside the 'back' button, navigates you to a raw txt file of websites and passwords. Then, at least, there would be no excuse, no naive assumption that chrome is doing SOMETHING to protect your passwords.
What we disagree on is the specific degree in this case. You think it's significant. I know it's not. Chrome's security design is denominated in thousands of dollars. This is a penny feature, and one with potential liabilities; it could cost more than it benefits.
Without it, I can't.
That matters.
I'm not thrilled by the security community's black-and-white stance that if it can't stop a defcon attendee, then it's not real security and it's not worth doing.
If my mom can be stopped, and it's simple to stop her, then I really don't get the resistance. 'False sense of security'? Yeah, that ship has already sailed. That's why the Guardian is writing articles like this - people are surprised to learn HOW trivial it is to steal passwords in chrome.
My mom? She asked a shop owner, two days ago, 'do you have a, uh, online thing? You know, with the pictures?'
And yet, "Mom, experiment: type 'chrome://settings/passwords' in my browser and see how many passwords you can steal in 60 seconds".
To me this would be a great solution and would improve Chrome's user experience. I am unsure why the strong argument against this.
Having someone able to casually browse your passwords versus intending to attack your system and breach your trust to get them is a big difference.
Can you not see that Chrome lowers social and emotional barriers to password access by presenting them in this form? That is the concern here.
You are presuming a specific environment and an attack specific to that environment.
At first glance, it may look like adding the extra complexity of a password through the obvious user-interface path improves security. But that assumes there are no costs. In this case the cost is a false sense of security - such that all other attack vectors are still just as open and now the user is less aware of them.
The user would be better off having the 'vulnerability' rubbed in their face so that they would learn to take measures like locking the screen whenever they walk away. That way when someone gets physical access for 5 minutes instead of 20 seconds, the passwords are still just as safe.
So Chrome wants you to feel secure and give you convenience. Either it makes some attempt to prevent casual password access or it informs you that your passwords are casually available. It can't have it both ways.
I agree that the user would be better off having the vulnerability rubbed in their face but Chrome does not do that.
Edit: You also need to take into account intent and the emotion of the user accessing the passwords. The system currently implemented in Chrome makes it easy to peek at someone's passwords without malicious intent. If you simply had to overcome some hurdles it would make most people stop and think about what they are doing because it is a breach of trust. We're not talking about stopping determined attackers.
Edit 2: Also, I presume that specific environment because it is the environment I work and live in every day. We bring our personal laptops to work, we debug code on each others' machines, and we occasionally step out of the room. Sometimes at home I take a friend's laptop to look something up, sometimes I lend mine. I think these are common scenarios for computer users (though admittedly I have no evidence for this).
And that's the logic behind Clippy. "It looks like you're saving a password? Did you know that if you to chome://indecipherable/arcane/nonsnese/ all your passwords are visible? Click [OK] to agree"
What do you think about the recent EU/UK cookie law? You're basically suggesting that for password.
I completely agree with that, I think that would be a much more useful fix.
> And that's the logic behind Clippy.
No, it absolutely is not. Chrome already asks and informs you that it is saving your password. It asks each time it saves a password. It already does this. It would simply be an additional line of information in a step that you already have to confirm by clicking "Ok".
Either you make some attempt to secure the passwords, or you let your users know that they are readable in plaintext. Don't do neither, like Chrome is doing.
Not everything is black magic and dark arts.
Both have since stopped storing passwords in Chrome.
Both developers expected their Keychain password to be needed before unmasking their stored passwords. It shocked them that this was not the case.
A better fix for this would be to require the Keychain password before showing all passwords. There is no harm in doing this.
They both use the word "save" to denote this functionality.
I don't think you understand why this difference in behaviour is important.
I expect some level of security to stop people browsing my passwords casually, which Chrome allows in its current design.
I am not talking about fending off determined attackers, I am talking about levels of trust that you place in friends and coworkers. Chrome lowers the barrier-to-access by design.
The simple fact is: there are people I would trust using my computer who would never actively try to circumvent my security to read my passwords, but I would not trust them not to take a peek at my Chrome settings page passwords.
Security is about far more than preventing determined, malicious attackers. It is also about being able to use your computer in a work or family environment with a reasonable expectation that your privacy will be maintained without explicit effort on your part.
You call them "attackers" but that is not who we are discussing. We are talking about people being able to casually browse your saved passwords, perhaps without even the intent to attack (maybe they just want to see what your passwords are).
Nor is this about the "incompetence of attackers." As soon as you add an extra step — such as requiring a master password to show a particular instance of a saved password — you increase the breach of trust required for a friend to violate your privacy. And it's not simply whether you trust someone or you don't, there are levels of trust between friends.
I have some friends that I would trust not to attempt to defeat my security, but I would not trust them not to casually browse my passwords. In this instance I would be safe with Safari but not with Chrome. See the difference? Chrome could easily implement Safari's solution for this and be better for it. Why defend the inferior design?
Security is measured in dollars; it is about the cost you confront your adversary with. Chrome has sunk many millions of dollars into blunting attacks that cost 6, 7, sometimes 8 figures. You're up in arms about a security measure that would add pennies (if that) of attacker cost. Justin and his team (rightly) observe that in return for the pennies of extra effort the feature you're demanding would add, they also incur a real risk that users will feel safer leaving their accounts unlocked. As you've already acknowledged repeatedly, if they do that, it costs pennies to get all their passwords.
There are all sorts of stupid extra steps you can add to make things harder for computer-illiterate attackers to compromise your accounts. Like I said, you could also Base64-encrypt the passwords. Or ROT14 them. Or Base64 and ROT14 them. How about you turn that into a round function and write the Base64+ROT14 Feistel network? That'll surely dissuade someone, somewhere from capturing passwords.
You will no doubt be able to come up with a 4 paragraph response to this comment. In ~20 years, I've never been able to deliver a killing blow in this stupid debate.
Chrome lowers the barrier and makes access casual where other systems require a stronger level of intent. That's the problem. I have no idea why you are defending this behaviour.
One requires a bit of manual effort and thought to get over for the casual user, the other becomes ignored by the casual user.
I'm not discussing malicious attackers, I'm not even discussing someone who is out to get your password. Chrome makes it possible, in seconds, for someone to reveal your passwords as a crime of opportunity.
* An FBI warning, like they have on DVDs, explaining the penalties for stealing user passwords.
* Automatically generate word-search puzzles like on the backs of chain restaurant kids menus, so that 5 year olds will have a harder time recovering passwords.
* Since most of the "attackers" the master password would block are probably senior citizens, typeset the passwords in a 7 point font.
* Since all of the "attackers" who would be thwarted by a Chrome master password are computer illiterate, make users answer a basic computer literacy quiz before showing them the password. You should have to be able to explain the difference between a library function and a system call when you push the "reveal password" button.
Note to The Guardian: I have at least 10 more similar "major security flaws" in Chrome (I gave up some more, like the red-green colorblind attacker countermeasure, on Twitter --- but I assure you I have 10 more) that I'm willing to disclose to you, and I assure you that you'll be able to find someone else on the Internet to give you quotes for your article about how terrible it is that Chrome has those flaws.
The difference I see is if my spouse or boss wanted to look at my passwords they could, easily. I'm not OK with that. Now, tell me they have to install a trojan, a virus or some other software first to get access to my passwords and thats a level of safety which stops my boss. My boss won't have the technical know how to do it. My spouse could be looking just out of curiosity, the smallest roadblock would stop them. Chrome's implementation makes it easy for anyone to see passwords and that's just wrong!
The length of time anyone will have access to an unsupervised machine plays a role here. It shouldn't take 5 seconds of pointing and clicking that my gran could do to reveal all my passwords. It should take someone more effort!
And for the record, when I saw this feature 2 years ago I disagreed with it too - but it's not a flaw.
Firefox should lose the feature.
EDIT: Your other comment at https://news.ycombinator.com/item?id=6173111 probably explains your view on this; that there are few attacks in practice which would be thwarted by encrypting passwords at rest, and that the false sense of security on the part of the user would be disproportionately high.
Surely they have to be reversible, or the browser wouldn't be able to use them as passwords.
- I understand the fact that the browser must be able to have the password in plaintext at the moment of logging to a website.
- I understand that if someone has access to my account on my computer then is able to access all the sensitive information that I have stored unencrypted on it, and not just my browser's passwords.
- I understand that is not something new or ground-breaking, or even something exclusively related to Chrome.
I still can't see how sensible having an option to show the passwords in plaintext, without protection, really is. Many people (non tech-savvy people in particular) for example do not lock their OS profile at all.
Requiring a Master Password by default (with the possibility of opting out in the settings) before using/showing passwords, and storing these in crypted form it would seem more sensible to me.
This is not a security flaw. Comparing browser password storage to a safe is mildly retarded.
It actually is impossible for malware to instantly send off all of your saved passwords if you're using Firefox and have a (reasonably decent) master key set up. I assume Opera has a similar master key option. The keyword however is "instantly."
Now, the malware can and will still of course modify HTML on the fly and steal your passwords immediately after you login to websites, but it would probably take quite a bit of time for it to collect nearly as many passwords as there are stored in your browser's password vault, especially if you use websites that don't require you to re-login very often. And the longer that time window is, the higher the chance the malware will be detected either by odd computer behavior, or an AV detection.
They can also set up a keylogger and wait for you to input your master password at some point. It can sometimes be hard to determine what logged text is actually the master pass, due to how many keyloggers work, but this is of course a viable option.
All-in-all, master passwords do in fact hinder attackers. The first thing many malware spreaders do is dump browser and other saved credentials (often FTP, sometimes IM accounts so they can spam malicious links to contact lists); it's often a quick "in-and-out" dumping process. It's not uncommon for malware to successfully execute and exfiltrate some data as soon as it's loaded, but later as it infects other files or drops additional payloads, AV will fire and the user will try to clean up the machine.
And then there are the very simple cases of "friend/acquaintance uses computer, looks at your passwords really quickly, memorizes a few, goes home and screws with your accounts at a later time." Master passwords make that sort of situation fairly impossible.
I really do not personally see why Chrome doesn't allow master passwords as an option. It would not be a security silver bullet, but it does help.
Chrome is designed for the layman.
Does it warn you that your passwords are effortlessly stolen by anyone that can access your computer? No.
Does it warn you they're at least not encrypted? No.
Do you think the average Chrome user knows this?
Do you think the average user understands computer security like us IT professionals?
Either it tells you that your passwords are readable (and thus you are less likely to trust it) or it makes some attempt to prevent your passwords from being read within seconds. It can't have it both ways.
Given that a user left their session unlocked (!) in the presence of someone who is not them (!!) with a password file and other sensitive data in easy reach (!!!) - why is it Google's problem that the end user violated the first three rules of computer security?
*ed Downvotes don't answer the question, guys. At what point do you stop taking extraordinary measures to protect the user from their own lack of sense?
Interesting to see the Guardian newspaper quoting someone from Hacker News.
Same is also true of Firefox - find the right path through the menu structure (different for each version) and reveal all your passwords.
Simple enough.
He isn't just some random commenter though, he is the tech lead of browser security (according to his comment, which I'm guessing The Guardian didn't actually verify :D)
Alternatively Chrome should inform the user that saved passwords are easily readable in plaintext, so that users will not trust it as much. It does not do this either.
There's a difference between browsing someone's private documents and having permanent access to their email account via their password.
Well, except that you can just dump the passwords from Keychain without the master password.
Browsing the Chrome's password page requires far less malicious intent than finding/writing a script to dump someone's keychain passwords.
That's the main issue for me with Chrome. I know people that I wouldn't trust not to navigate to chrome://settings/passwords, yet I would trust them not to actively attempt to defeat my computer's security (no matter how feeble).
Chrome makes it easier to breach trust. A bad design.
Well, yeah, I'm certainly not seeing any point there.
> Browsing the Chrome's password page requires far less malicious intent than finding/writing a script to dump someone's keychain passwords.
No, it doesn't. It might require somewhat more effort, but it doesn't require any different amount of intent.
> I know people that I wouldn't trust not to navigate to chrome://settings/passwords, yet I would trust them not to actively attempt to defeat my computer's security
Intentionally navigating to chrome://settings/passwords is no less an active attempt to defeat security than doing a command line dump of the keychain passwords is.
> Chrome makes it easier to breach trust.
Its trivially easy to breach trust in about a million different ways if you are given unsupervised accessed to an unlocked OS user account with sensitive information attached to it. Chrome does not make any significant difference to that.
> Intentionally navigating to chrome://settings/passwords is no less an active attempt to defeat security than doing a command line dump of the keychain passwords is.
I know people who would navigate to chrome://settings/passwords right in front of me as a way to annoy me — to force me to change my passwords. Their intent would be to annoy and not to attack. The fact is that you need less motivation, and less intent, to go to the password page than to deploy a script / modify the DOM / do any number of other things to get a user's passwords.
Navigating to that page is less of an active attempt to defeat security. Hell, even I feel like it's something I would try on someone's machine when I would never even consider breaching security in another way.
> Its trivially easy to breach trust in about a million different ways if you are given unsupervised accessed to an unlocked OS user account with sensitive information attached to it. Chrome does not make any significant difference to that.
I consider the difference to be significant. I want Chrome to improve its design in this area.
Either securing this page or informing the user that their passwords are readable would be a better design than what is currently implemented. Are you arguing this is not the case?
Just because you can do it a million other ways does not mean you should be fine with this way of accessing a user's private data.
Click 'View page info'
Click 'Security'
Click 'View Cookies'
I just bypassed your Firefox/Safari/etc master password and owned your session. OH NOES, SECURITY FLAW!!!! (I also downloaded a rootkit and installed it in your user's home directory, but you probably don't find that as much of a flaw as me getting your cookies. Right?)
I will say that encrypting the passwords on-disk is a nice thing if you care about cold-rebooted disk attacks and don't implement disk encryption yourself. But the game is mostly over if they have access to your machine. If the machine is still on, a DMA or cold boot attack is probably going to net them the passwords even on a master-password-locked browser, because the browser still needs to access the passwords for forms without prompting you every time.
And enter your master password if you use that, which you should, if you're storing passwords at all.
The answer is also kinda obvious. It started it as a matter of convenience ("I'm too fking bored to type out my long-ass password" or "I have so many passwords, I can't be bothered to remember them all" or "LastPass? What's that?") and has remained so till date. In fact, it will continue to do so until a zero-day exploit appears that can uncover these plaintext passwords, which, judging by current events, doesn't seem too far away
http://raidersec.blogspot.com/2013/06/how-browsers-store-you...
Next up: Android wireless passphrases are also stored unencrypted!