Hacker News Reader

Comment by alec | Hacker News Reader

Stores passwords in plain text on disk: http://code.google.com/p/chromium/issues/detail?id=25404&...

I noticed that detail when I was trying out Chromium a while back, and it still hasn't been fixed. It seems like a simple but basic security feature. I don't know what else isn't done yet, but it does make me worry. No guarantees that Firefox isn't doing similar things I'd object to, but I don't know about them, so for better or worse I have more confidence in it.

View on HN

Firefox does the exact same thing unless you setup a "master" password that you have to enter when you launch it.

What's the alternative?

Even if it encrypts the password before storing them on disk, the encryption/decryption key are necessarily on disk anyways, no?

You can make the user enter a master password.

No.

You can use a master password to decrypt your encrypted password database.

Your operating system might have a keyring service or an encrypted filesystem you can use to store your keys in.

You might even use a hardware token, or some specialized on-board hardware for storing your passwords securely.

It's just a matter of time to find the right auto-fill form and replay the HTTP post data.

Every desktop environment that I'm familiar with (OSX, KDE, Gnome) has a built-in password manager to hook into, that stores the data encrypted and prompts the user for a master password in some configurable way. I'm guessing that if the OSX and Linux variations of Chrome get any traction, hooking into the password manager will probably be done.

I have no idea if Windows has a password manager, but I don't know why it wouldn't.

The OSX version seems to use KeyChain.

How about just not using the browser to store you passwords?

Reply on news.ycombinator.com