Showing stored passwords – Tim Berners-Lee
lists.w3.org
lists.w3.org
The dimwit Chrome developers continue their dumb insistence that penetrable security shouldn't exist.
"Bathroom doors shouldn't have locks; someone could just kick the door in and then where would you be!"
"Houses shouldn't have locks; you've got glass windows, don't you?! It's a false sense of security!"
"Prisons shouldn't have 20-foot walls; Home Depot has 21 foot ladders, don't they?! Lex Luthor escaped via helicopter! It's a false sense of security!"
"Bicycles shouldn't have locks; there are bolt cutters with five-foot handles, aren't there?! It's a false sense of security!"
Of course in the real world, where Chrome developers do not live, we use locks in all these cases. There's a combination of social signalling (this is mine; do not disturb it) as well as legal signalling (locked means an affirmative action must be taken to break the security, which is punishable; unlocked is not punishable) as well as a substantial amount of actual security (the reality is not everyone carries five-foot bolt cutters, even if some people do).
Maybe I can put it another way: Android, up through 4.2, only contemplated a single user per tablet. So if you gave your kids (or anyone) the tablet to play with, they had FULL and unrestricted access to your Gmail account, Google Play account, and so on. Someone, eventually, slapped some sense into the Android developers and now Android 4.3 has restricted profiles where you can let the kids play games without giving them access to your Google accounts.
That someone needs to get their slapping gloves and wander over to the Chrome development team...
If you're accustomed to thinking of security in this all-or-nothing way, the Chrome team's argument makes sense. And the state of the Internet encourages this kind of thinking. In the real world there are plenty of gray areas to security, but online there's always a sufficiently advanced and determined attacker.
Nitpick:
Bathroom doors should have easy breakable locks (if any at all) because of danger of carbon monoxide poisoning; locked doors may be the only thing that stand between you and dragging out unconscious family member from danger.
I for one was always taught as a kid to not lock the bathroom when taking a bath.
Not as common today as they once were but there are still plenty of them.
[edit] I found an academic paper that discusses the safety of these heaters - dated 1973. I'd guess that they've gradually disappeared thanks to better heating systems and improved safety regulations. The paper: http://hej.sagepub.com/content/32/4/120.abstract
You are of course right in pointing out that central heating often goes along with central water heating and that heating is often based on fossil fuels such as gas.
My hot-water + heating system is gas-fired, but the boiler is in a utility closet vented to the outside.
Fortunately she was only scared but otherwise ok. Quite the bang, I've had a healthy respect for old Junckers products that have gas lines fed into them since.
Jacques, if you happen to come to Poland again, shoot me an e-mail, I'll buy you a beer :).
That might be quite soon actually. I'll be travelling to Krakow and on another trip I'll be going to Bialestok.
My cell is + 31 6 30 366 241, I won't have email during those days. Send me a text please so I'll be able to reach you when I'm there.
Let me continue this conversation via e-mail then.
I use Firefox, but it seems from the screenshots that Chrome has that minor barrier of clicking before they reveal the password.
I don't understand the big deal here. You shouldn't be storing your passwords at all in a browser.
http://raidersec.blogspot.com.au/2013/06/how-browsers-store-...
It reads and decrypts every password you have on startup.
Safari and Firefox don't try to get the password until there's a form to put it in, but that's not good enough for Chrome.
I only use Chrome for testing apps, never for real use.
Grind your axe elsewhere; it's sad.
Chrome's threat model [1] paints a different analogy. In their view—which I do think is reasonable—the OS is the house and Chrome is simply a room in the house. You don't put locks on all of the interior doors of your house to keep out burglars who might've bypassed your front door, do you?
Their threat model makes sense for many users, and it's flawed for many others. One valid criticism that I do support of Chrome's model of handling passwords is the obscurity of it all. Users as a whole should certainly have a much better idea of how their passwords are being handled.
[1] http://www.chromium.org/Home/chromium-security/security-faq#...
Most single family homes do, in fact, have locks on interior doors. And they're built that way, as that's what most people want.
Or you could just disable password saving. This is one of the first things I do when I get a new browser or computer. I don't want the browser remembering my passwords.
(Since that is about the same friction as running a soon to be extremely well known piece of javascript, or accessing a site to copy-paste it from.)
It might be proper security engineering practice, but it strikes me as being totally out-of-touch with regular humans and mere mortal users to insist that once any attacker has access for any duration, you're completely hosed anyway, so why not make it easy for them.
It's very hard to stop a determined attacker, but that's not what this is covering. As a developer sometime I peer program, and that might mean handing over the controls to a colleague. Now I trust my colleagues, but you never know what their personal lives might me.
If I had, say, saved my internet banking password (I don't, but let's entertain the possibility) they could easily access the password list and copy it, then close it without me ever knowing.
It's much like leaving an open safe under my desk. Even if it's a simple lock people won't open it to see what's there. If you know I have a stack of gold you might decide to break in, but you'll know it's wrong.
An unskilled attacker with instructions can type in a url to get a password dumper, and be in and out in 30 seconds plus memorization/transcription time.
Locks on your front door knob are not there to keep out burglars. They're there to prevent opportunistic crime: someone who tries that doorknob out of curiosity and discovers a home full of stuff and no one around. There's a large middle ground between good guys, bad guys, and those who might, just might, be tempted to be bad when they find that suitcase full of money. That's what Google is missing here.
And in a condescending response[1], someone who is allegedly the Google head of Chrome security called the original author a "novice", claimed Google has "quite a bit of data" to back up their case (without describing the data, its source, or how it was evaluated), and suggested that a master password would make security worse by providing a false sense of security.
First, I would suggest that if Google really does have the data mentioned in the claim, release it. Second, a master password isn't going to make the computer safer from a determined black hat because physical access to the machine means game over, but THE MASTER PASSWORD IS NOT ABOUT PROTECTION FROM BLACK HATS.
When the colleague who hates you is standing by your unlocked computer when you're off to get coffee and suddenly realizes that he not only can read your email now, but at any time he wants to in the future, that's a problem — when your partner gets suspicious about your working long and you've forgotten to log out — when your little brother realizes he can post "funny" pictures to your Facebook page ... when, when, when ... there are so many areas where this could cause a lot of pain. For example, this is from a blog entry I wrote a decade ago about a young lady who was compromised because LiveJournal stored her username in the cookie and the conservative, religious parents found her blog[2]:
I know of a young lady who kept an online journal. Her
parents found it and started reading it and were
horrified to find out that she was suffering from --
brace yourself -- teen angst! Her parents don't
understand her, not enough boys like her, she's not very
popular, etc., etc. In reading through the journal,
there are no references to doing drugs, sex, or anything
else that one might expect a parent to worry about, but
this young lady's parents hit the roof. They forbid her
to keep an online journal and they grounded her
(naturally, I'm sure this cured the angst problem).
Google is optimizing against black hats but pretending that opportunistic crime doesn't exist. In physical security, opportunistic criminals tend not to be the brightest or think too deeply about what they're doing, but when the opportunity is there, they go for. Google is happy to give them that opportunity.
1. https://news.ycombinator.com/item?id=6166953
2. http://use.perl.org/use.perl.org/_Ovid/journal/13471.html
But I could just as easily conceive of an attacker who knows how to read a computer screen but doesn't know how to use basic window management, and thus conclude that the browser window should always display all saved passwords as long as the user can minimize the browser.
Or toward the other end of the continuum, I could conceive of an attacker who knows how to install a keylogger but doesn't know how to lift and spoof fingerprints, and thus conclude that the browser should require a fingerprint scanner to recall saved passwords.
These arguments need to establish why the line should be drawn in that specific spot, rather than just mentioning the line and describing the types of attacks it can thwart.
Oh come on, writing a bookmarklet is not a fair comparison. A fair comparison is the little brother googling 'chrome passwords' and finding a link to chromereveal.com[1] That's a more interesting activity than wandering around settings.
Download: Less than five seconds
Run: If it's a custom tool, less than five seconds to have passwords displayed
Delete: click the 'remove' button on the downloads list, less then five seconds
In terms of bike locks, this is one you can take off with a pen and no previous practice.
And by the way, you also forgot deleting the dumper site from the browser's history, (and DNS/proxy records if they're being logged) using a system password to install the software if the system has that kind of security, and so on. But I digress, the point is not that a master password will keep a determined or informed interloper out, it is that it will "keep an honest person honest."
No. I'm still a bit undecided on whether a safeguard would be worth adding or not. What I'm arguing is that many of the people making points in favor of a safeguard are doing so on weak reasoning, where they overestimate the effectiveness of it against a casual, untrained attacker. No foreknowledge is needed to make a search, and if you find instructions then I very strongly disagree that running a program is harder than navigating settings.
> deleting the dumper site from the browser's history, (and DNS/proxy records if they're being logged) using a system password to install the software if the system has that kind of security
Oh come on. This is supposed to be a casual situation where you let someone use your computer. What kind of history-monitored remote-logging computer is going to have saved passwords and unauthorized access in the first place?
> keep an honest person honest
You already have to enter a page solely for editing passwords and hit specific show buttons per password. There is zero plausible deniability at this point. I think an 'honest' person will already be kept out, and any changes would only matter in marginal situations.
So what exactly is the harm or downside? Firefox has it. Neither Safari or IE display passwords in this manner either.
>No foreknowledge is needed to make a search, and if you find instructions then I very strongly disagree that running a program is harder than navigating settings.
Making a search is how you would acquire the foreknowledge. I was talking about an unskilled user acting in moment of opportunity - not someone who has researched password cracking and has unfettered access. I would bet that an employer, or an IT department, or a jury would see a difference between downloading & installing software on a machine and just opening the settings on it.
>Oh come on. This is supposed to be a casual situation where you let someone use your computer. What kind of history-monitored remote-logging computer is going to have saved passwords and unauthorized access in the first place?
Look, this could be in the workplace when someone gets up from their desk to go to the bathroom or get a cup of coffee. Chrome is on every platform. Some systems require administrative privilege (and a system password) to install new software but none is required to open chrome and veiw settings. I use a DNS service at home to watch what sites my kids use. I would know (albeit after the fact) if they downloaded a pw dumper. Lots of companies use firewalls and the like too. I was speaking about covering one's tracks - in any setting not just the kind you imagine.
>> keep an honest person honest
It is a reference to an old locksmith saying, specifically: "Locks are on doors only to keep honest people honest."
A more sufficient version of your argument would attempt to show why the master password is an appropriate place to draw the line on this continuum, perhaps by arguing that it's an optimal balance between minimizing the valid user's frustration and thwarting some percentage of attackers.
The correct place to draw the line is a place where the user has every convenience they want, and an attacker does not have any additional convenience.
Revealing plaintext passwords does not convenience the user but it would convenience attackers (with low skill).
That bit is not true, with a caveat.
I have a ton of low-security username/password pairs stored in FF. I find I do need to look at the plaintext passwords now & again, because I want to open one of those sites on my phone, for example, and don't remember the password (I looked up my HN password just yesterday so I could sign in on my phone, actually). Sometimes I find I've saved multiple pairs for one site, and I need to review the passwords to figure out which is valid.
I've used the same feature in Thunderbird with IMAP and SMTP server passwords, when I have an email account I've been using for year w/o changing the password, and I realize I haven't saved it anywhere else.
All of these are not hampered by requiring a master password, of course... I'm in agreement with timbl on his reasons not to allow just anyone to view these by default.
https://news.ycombinator.com/item?id=6165708
Here are some other submission:
https://news.ycombinator.com/item?id=6167331
https://news.ycombinator.com/item?id=6171813 (many comments)
https://news.ycombinator.com/item?id=6171979
https://news.ycombinator.com/item?id=6173106 (many comments)
https://news.ycombinator.com/item?id=6173582
https://news.ycombinator.com/item?id=6175012
Here we have a response from a security head that it's silly to try to be secure if the person has physical access, or at least the Chrome team can't trust anyone else's app.
What if you leave your desk for the bathroom and forget to lock it? Or put chrome on a flash drive? Or have settings stored in a non-default location? Or heaven forbid a clever virus manages to get on and all it does is try to look at passwords?
Leave your desk and forget to lock it? Uh, then anyone that sits down keeps your user sessions. Unless you've configured things to prompt for passwords everywhere (like Vista UAC) then they have access to plaintexts you would.
Users aren't going to want to type in a password every time they open their browser. Non-sandboxed OSes can't really enforce any security there. And users hate re-entering passwords, this is why they are saving passwords in the first place.
You're arguing "yeah, but just because I logged in as root doesn't mean I want to be able to run root commands".
His response is correct.
In fact, almost any of your applications could already be doing this, since it's not sandboxed. Game over. Might as well remove it. Users hate being logged out anyway.
edit: I'm quite serious. incognito mode is "privacy theater". by the same logic, it should be removed.
It should be on by default — like Safari where it uses your keychain password when attempting to display a plain text stored password. Chrome and Firefox could easily do this too (they do use the Keychain to fetch passwords anyway.)
Note: Your ISP and the NSA can be logging from their end to, without access to your machine.
If I leave my desk to go to the bathroom for a few minutes then I take my chances with any malicious actors with access to my hardware, sure, we can call that "game over".
But that scenario doesn't make much sense in reality - if someone is that close and has such a malicious intent, why don't they simply hit me with a 5 dollar wrench[0]?
Whoever happens to be feeling malicious in my office ought to have to act out their malice deliberately - and not simply to be able to click a single button to retrieve all my personal passwords.
That's not "browsing passwords". That's clear, malicious, intent. It's like someone in your room looking at the bottom of your underwear drawer for secret items. Chrome is in no way popping passwords up in front of friendly unsuspecting visitors.
Do you not lock your house at all because the worst-case scenario is that the burglar is a master lock-picker (and you can't afford the ultra-expensive takes-30-minutes-and-powertools-to-break locks)?
Using the worse-case scenario to guide all of your decisions makes more sense when the threat/attack is coming form the Internet, where the likelihood of the attacker being skilled significantly increases.
I agree that there's some malicious intent. But the fact is that I would personally feel less guilty about doing this on my coworkers' computers than I would modifying the DOM after the password had been auto-filled.
I think this applies to a lot of people who argue for adding a master password unlock to view stored passwords in plain text.
Look, this ain't some high brow crypto discussion. It's a complaint that passwords show up in plaintext on the screen. We're trained all the time to not look when people type them in, they're covered with dots on forms, and we don't leave them lying around for anyone to see.
Sure some people do, but not everyone can be saved from themselves. But it sure as heck feels wrong, and this is by and large an interface problem, not a security problem.
Finally, someone else noted that the passwords actually not actually saved as plaintext, removing the real fear that the passwords can be gotten if the hard disk is merely read elsewhere. So it's not even a security risk, so long as no one makes an add-on that can grab those passwords in plaintext, which would be darn near insane.
(Am I the only one who thought key rings and such existed to mask the password so no one but the authorizing runtime ever saw the password as plaintext? (As in an app points to the key store and then another trusted program handles the actual password transaction so the first app never has to know it.) I can't be the only person who thought there was something more clever at work, I hope? Chances are I'm just too trusting.)
[1] http://msdn.microsoft.com/en-us/library/aa380261%28v=vs.85%2...
My personal suggestion would be for an optional user-provided password. I would be surprised if most people who wanted extra Chrome security would mind typing in a password once after starting it.
That's not how protected storage works on Windows. It's just a simple crypto API. You give Windows some data, it encrypts it with a (user/machine/process) specific key and returns it. It's up to Chrome to store it. So, any bad software would already need to target Chrome's settings files, so hard-coded (or install generated) entropy adds nothing.
There is the Windows Credential storage which is system wide (I think IE uses that), but Chrome does not, to my knowledge. (I've got a hundred entries in Chrome, and only a few certs and passwords in credstore.)
> would mind typing in a password
This is an entirely different suggestion and that sounds like a decent feature but not really. If you want a password manager like PasswordSafe that stores passwords "safely" (and does auto-relock, moves around in RAM to avoid any "ghosting" effects, etc.) then use a dedicated program. Adding it to Chrome adds complexity for little additional security (if your workstation is unlocked, it's almost definitely game over).
And the original article is talking about non-technical friendly culture of leaving stuff around unlocked. Even with a master password, Chrome is left open all the time anyways. So it's a doubly dubious feature. You'd need to add auto-relocking, etc. etc.
If Chrome does all this, one of the Chrome members should implement a lightweight, benign exe that undoes it all in one quick move, shows you passwords, then deletes itself. So you can just hit like new incognito window, https://url.thing/chromepass and immediately undo it all, just to remind people how silly it is.
Edit: Remember that most security threats are remote, and Chrome has been doing a fantastic job on the actual security model. Cert pinning, for instance, prevents vastly more attacks than this complicated password thing would do. Wikipedia says Chrome (and new Safari) are the only current browsers to support TLS > 1.0 (needed to prevent some attacks).
I'm glad the Chrome team is moving with a real threat model, rather than hand-wavy stuff.
The attack is by colleauges, members of family, etc, not by hardened black hats.
As readily available as tools like John the Ripper and its various clones are, the average user (parents, schoolmates, stalkers) probably won't think or be able to operate such a tool. These are the kinds of attackers who will, when asked for a master password, either start guessing or just give up. Hence:
Well, in a lot of places with say teenager culture or work groups, if you leave your computer open you know people will read your facebook and may even send messages as you largely for fun.
It is a different damage level of security failure for someone to get hold of the password and be able to log in and stalk them at any time in the future.
If you sit down at my unlocked session of Gmail, yes, you can read my mail or send email. But you can't get my Gmail password--which would allow you to log into my account later from your computer.
If I'm using Safari, you have to look in the OS X Keychain Access software, which hides passwords by default. If you check the box for "show password", you have to enter my OS X password before it will show it to you. You can't get it.
If I'm using Chrome, you can just go to the saved password interface and write down what you see. Stalking achieved.
I don't know the details of the OS X keychain. If they indeed validate programmatic access to the keychain by authenticating the code executing (that is, verifying Chrome by Google is accessing the same data stored), then sure, it's possible to do somewhat better.
But if the browser prepopulates fields and they are inspectable, that defeats the purpose, yet again.
As a real world analogy, what about easily-climbable fences? Those are often a useful deterrent, and they make trespassing litigation more likely to succeed.
[1] http://rimuhosting.com/knowledgebase/linux/misc/preventing-b...
[2] http://serverfault.com/questions/189282/why-change-default-s...
This is the basis of much of the argument in favor of Chrome's approach:
>In all cases, if you have access to the machine, all it takes is trivial software that's widely available to snoop on anyone else using the machine.
This has been repeated elsewhere including by the Chrome security engineer in so many words. Paraphrasing, "if you've got physical access to the machine, everything else is just theater, so we just go ahead and make that obvious."
But.... OSX requires the admin password before installing any software. That would seem to invalidate the above argument.
Or is there actually a way to bypass OSX Keychain.. and if so how "trivial" is it? Certainly nothing comes up in a quick google search. You'd think it'd be big news, that Apple's whole security framework is just "theater".
Is this really true for OS X Keychain? Are its admin password prompts for actions like installing system components or displaying secrets in the UI just theater?
Open a new tab, Google "safari reveal password javascript", open the second or third link, drag the bookmark, reveal the password.
The other comment in this thread about locking doors is a good analogy. The chance that locking my door (in a house with many ground-floor windows and no home security system) will deter an actual burglar is nil. But it could certainly deter some strange neighbor from sneaking in and perhaps stealing things.
on the other hand - justinschuh mentioned that they've "literally spent years evaluating it and have quite a bit of data to inform our position". Opinions formed off the top of our heads don't mean that much.
Baffling to me really, especially coming from Google.
They are going to turn around on this, I am certain of it, but why it's taking them so long is beyond me.
This model is clearly lacking, and is not appropriate for software as widely deployed as Chrome.
He made the same counter-argument, that if you handing over your computer over to someone you don't trust, 1Password should be locked — his locks after a short timeout and whenever he put his computer to sleep.
These arguments are way more eloquent than mine though.
I like the idea of there being a challenge in Chrome before my passwords are displayed, but its actual impact on actual security is pretty negligible.
A challenge dialog is going to deter the "casual" snoop. I'm all for it as a defense-in-depth measure. My point is that you can encrypt your passwords all you want, but even in that case, physical access is game over because there are additional attack vectors that don't require a passphrase to breach.
And honestly, if I left my computer alone in a coffee shop or library, I'd be much more worried that someone would pick it up and walk off with it than that someone is going to look at my Chrome passwords. Good luck memorizing those 16-character randomly-generated phrases that I can't reliably remember after two months of repeated use.
I think the "casual" snoop is far more likely than the determined attacker with physical access. Which is why the Chrome team's position on this is baffling.
There are so many cases where I hand my computer over to coworkers, friends, family. I trust them all not to explicitly circumvent the security of my machine, but I definitely don't trust some of them not to "casually snoop."
You are definitely right about my leaving the computer alone example. That was pretty absurd.
Requesting a password would provide a false sense of security. The passwords are stored in an easily obtainable format. If you are leaving your laptop around untrusted people, you're going to have problems.
Trying to draw a line around the secure point (having a workstation totally unlocked) sounds incorrect.
The passwords are stored in an easily obtainable format.
If you are leaving your laptop around untrusted people, you're going to have problems.
Why is it only the browser developers who come up with that arguement? I've never read such a statement from any other team. And why aren't other software systems do it that way if it is so insecure and "falce-security" so encrypt user passwords in a local db? Couldn't even an OS use that argument and say "hey, you got physical access to the system, here are all the passwords in plain text, have fun!".
They are; it's called your user account password.
If you mean an extra password, the answer is that most people don't want to type in a password when they open their browser. And even if they did, then the argument would be "well they leave their browsers open, so it should ask for a password every time", which defeats the whole purpose of password saving.
Think it through and try to see the issue.
Or do you mean that it'll prompt people for a master password for uncommonly used sites? Because that's just going to lead to people forgetting the master password and having to do a password reset.
If you mean an extra password, the answer is that most people don't want to type in a password when they open their browser. Think it through and try to see the issue.
I like the way this is handled in Opera, where your passwords can never be accessed/viewed in plain text at any time. Once your login data are stored, you can simply use them via CTRL+ENTER on the login form and the data is pasted into it. If you want to you can use a master password to restrict access to that data. And you can even set a time after which the the browser will forget that password and then asks for it again after e.g. 15 minutes.
But seriously: Yes, of course you would. They have to be pasted in clear text. There is no other way to do this.
But that's not the point. The point is that you do not get to use CTRL+ENTER in the first place! Unless, of course, you type in the master password, which Opera will forget after x minutes (zero if you want it to be forgotten instantly). So you have a windows of x minutes after I've used the password manager for the last time to do your "DOM hack".
http://raidersec.blogspot.in/2013/06/how-browsers-store-your...
Also, if you're on FF, do yourself a favour and turn on a master password before it's too late (Tools > Settings > Security).
I think this also encrypts the stored passwords, but I'm not sure about that.
Shouldn't the browser be keeping track of those it has autofilled and prompting for a password before exposing them there, too?