Comment by jellicle | Hacker News Reader

Comment by jellicle | Hacker News Reader

And this is why I don't use Chrome, nor recommend it to anyone.

The dimwit Chrome developers continue their dumb insistence that penetrable security shouldn't exist.

"Bathroom doors shouldn't have locks; someone could just kick the door in and then where would you be!"

"Houses shouldn't have locks; you've got glass windows, don't you?! It's a false sense of security!"

"Prisons shouldn't have 20-foot walls; Home Depot has 21 foot ladders, don't they?! Lex Luthor escaped via helicopter! It's a false sense of security!"

"Bicycles shouldn't have locks; there are bolt cutters with five-foot handles, aren't there?! It's a false sense of security!"

Of course in the real world, where Chrome developers do not live, we use locks in all these cases. There's a combination of social signalling (this is mine; do not disturb it) as well as legal signalling (locked means an affirmative action must be taken to break the security, which is punishable; unlocked is not punishable) as well as a substantial amount of actual security (the reality is not everyone carries five-foot bolt cutters, even if some people do).

Maybe I can put it another way: Android, up through 4.2, only contemplated a single user per tablet. So if you gave your kids (or anyone) the tablet to play with, they had FULL and unrestricted access to your Gmail account, Google Play account, and so on. Someone, eventually, slapped some sense into the Android developers and now Android 4.3 has restricted profiles where you can let the kids play games without giving them access to your Google accounts.

That someone needs to get their slapping gloves and wander over to the Chrome development team...

I think it comes down to how the Chrome team is used to thinking about security. Most of Chrome's security work, such as the phishing blacklist and the process sandbox, aims to prevent attacks from malicious web pages. In those circumstances, "pretty good" security gets you nowhere. If there's a difficult but known way to break the sandbox and execute arbitrary code, it needs to be patched. Otherwise, the hole's obscurity won't prevent people from distributing exploit kits. A subtly broken sandbox is almost exactly as secure as no sandbox at all.

If you're accustomed to thinking of security in this all-or-nothing way, the Chrome team's argument makes sense. And the state of the Internet encourages this kind of thinking. In the real world there are plenty of gray areas to security, but online there's always a sufficiently advanced and determined attacker.

If you run Chrome on OS X and have the keychain set to prompt you on every access you'll notice that Chrome does something really shocking.

It reads and decrypts every password you have on startup.

Safari and Firefox don't try to get the password until there's a form to put it in, but that's not good enough for Chrome.

I only use Chrome for testing apps, never for real use.

Not knowing why they did this, my guess is it's faster. When you go to site-that-requires-a-login.com Chrome can have the password box populated immediately instead of needing to ask Keychain for it.

Don't make people believe this bs, just have a look at how many people have problems with exactly THIS "feature": http://www.google.com/search?q=kwallet+chrome+opens including myself.

> "Houses shouldn't have locks; you've got glass windows, don't you?! It's a false sense of security!"

Chrome's threat model [1] paints a different analogy. In their view—which I do think is reasonable—the OS is the house and Chrome is simply a room in the house. You don't put locks on all of the interior doors of your house to keep out burglars who might've bypassed your front door, do you?

Their threat model makes sense for many users, and it's flawed for many others. One valid criticism that I do support of Chrome's model of handling passwords is the obscurity of it all. Users as a whole should certainly have a much better idea of how their passwords are being handled.

[1] http://www.chromium.org/Home/chromium-security/security-faq#...

> the OS is the house and Chrome is simply a room in the house. You don't put locks on all of the interior doors of your house to keep out burglars who might've bypassed your front door, do you?

Most single family homes do, in fact, have locks on interior doors. And they're built that way, as that's what most people want.

> "Bathroom doors shouldn't have locks; someone could just kick the door in and then where would you be!"

Nitpick:

Bathroom doors should have easy breakable locks (if any at all) because of danger of carbon monoxide poisoning; locked doors may be the only thing that stand between you and dragging out unconscious family member from danger.

I for one was always taught as a kid to not lock the bathroom when taking a bath.

There's a danger of carbon monoxide poisoning in the bathroom???

If you have a gas fired bath water heater in there, yes.

Not as common today as they once were but there are still plenty of them.

In the US? Perhaps in other countries, but in the US, I've never seen a water heater in a bathroom.

Absolutely. Certainly not common, but I've seen a few in the desert.

right - I live in the US nowadays and nobody has them - but back in the UK they're all over the place - stay at someone's house and there's a good chance they have one

I've never heard of such a thing, let alone actually seen one in a bathroom. I've lived in the UK for all (bar a couple of years) of my life.

[edit] I found an academic paper that discusses the safety of these heaters - dated 1973. I'd guess that they've gradually disappeared thanks to better heating systems and improved safety regulations. The paper: http://hej.sagepub.com/content/32/4/120.abstract

All the people who had them died of CO poisoning.

I have one and I live in the UK, so the definitely do exist. Of course, I may be unique.

They are still alive and well in slum housing. I know several people who have gas heaters in the shared bathroom of their block of bedsits.

You presumably have central heating in your house, and hot water? If so, you probably have a boiler. And this boiler probably runs on gas!

We have central heating but the boiler runs with a heat pump driven by electricity.

You are of course right in pointing out that central heating often goes along with central water heating and that heating is often based on fossil fuels such as gas.

The comment was referring to "gas fired bath water heaters", which appears to be a specific type of heater fitted in bathrooms for heating the bath water…hence the potential for increased CO risk in the bathroom.

My hot-water + heating system is gas-fired, but the boiler is in a utility closet vented to the outside.

In Poland quite common 'till very recently; I still have one (just reminded me to buy a CO detctor). My two friends actually got poisoned by CO - one when taking a bath, the other when trying to rescue her - because the landlord didn't bother to maintain ventilation properly.

I've had one blow up in Poland. Ul. Winklera, Poznan. I'll never forget that. My s.o. was about to use the (common for three apartments) bath and the thing blasted its outer cover clear across the room. She ran into the hallway totally forgetting her state of dress or lack thereof. The neighbours, alerted by the explosion that something was up, all piled into the hallway and sure appreciated the view.

Fortunately she was only scared but otherwise ok. Quite the bang, I've had a healthy respect for old Junckers products that have gas lines fed into them since.

Good that nothing happened to her except getting a bit scared.

Jacques, if you happen to come to Poland again, shoot me an e-mail, I'll buy you a beer :).

Deal :)

That might be quite soon actually. I'll be travelling to Krakow and on another trip I'll be going to Bialestok.

Great, I actually live in Kraków :).

Oh cool. You're Jacek right? I'll be there the 30th and the 31st of August (wedding).

My cell is + 31 6 30 366 241, I won't have email during those days. Send me a text please so I'll be able to reach you when I'm there.

Jacek, right :).

Let me continue this conversation via e-mail then.

Thanks for your explanation, I have never lived in a home with water heaters directly in the bathroom.

I think the more likely reason is in case you start to drown in the bath.

Every modern bathroom lock I've seen in the last decade or so can be opened from the outside with a coin. A quick Google suggests this is a legal requirement in public buildings, and simply a good idea in private homes.

I use Firefox, but it seems from the screenshots that Chrome has that minor barrier of clicking before they reveal the password.

That is a very specific design for bathrooms. Modern houses tend to have a bathroom with strong ventilation that pushes air out from the house. As such, most bathrooms door tend to leave rather larger space at the bottom for air flow into the bathroom.

The reality is, you mistake a browser with a house, when the OS is the house. Let's rail on every OS distribution that defaults to unencrypted drives! And every digital device that has not bio-metric and multi-factor authentication!

Grind your axe elsewhere; it's sad.

It's not THAT unusual, on entering a house through a locked door, to find your way blocked by another door that needs unlocking. (One or both of these doors might even have two locks.) And then inside this locked house there will quite probably be rooms with locks on their own doors. And inside some of those rooms, cupboards, with doors, with locks on 'em! And look inside enough of these lockable cupboards, and you might well find a safe. With a door with a lock on it...

So, I guess you don't carry the keys to your rooms and cupboards. Every time you want entry, you use a safe with significant entropy for OTP to the cupboard or room you want access, and the access is revoked 1 min after idle. Every time and everywhere. Ludicrous.

I guess someone needs to start slapping iOS developers.

this is why I don't use Chrome

Or you could just disable password saving. This is one of the first things I do when I get a new browser or computer. I don't want the browser remembering my passwords.

FWIW, Hixie, whom timbl is responding to, isn't on the Chrome team, though works at Google.

What if you could install an extension that disabled the "show stored password" feature? Would that make a huge difference to you?

(Since that is about the same friction as running a soon to be extremely well known piece of javascript, or accessing a site to copy-paste it from.)

For android, you could and still can get kid launcher sandboxes that prevent people accessing other apps.

It seems to me that the differential between those who know what a bookmarklet is and those who know that you can see everything in the settings menu is very small. So you're not talking about a huge effect here.

Your comment is all over the shop.

I don't understand the big deal here. You shouldn't be storing your passwords at all in a browser.

http://raidersec.blogspot.com.au/2013/06/how-browsers-store-...

Reply on news.ycombinator.com