3 ms·
No, there's a reason password managers should be preferred. For example, sometimes (browser) sandbox escapes grant reading of arbitrary files. Take for example
by Xylakant 8y ago
No, there's a reason password managers should be preferred. For example, sometimes (browser) sandbox escapes grant reading of arbitrary files. Take for example the recently discussed malware scanner the sent the browsing history, it could read such a file and transfer it back.
- UncleMeat 8y agoIf you have malware on your device you lose already. It can just read memory out of your browser process and steal your passwords.
- thaumaturgy 8y ago"Just". Modern browsers and OS kernels have extensive mitigations against this. Reliably extracting a password from a browser process's heap would be newsworthy today.
- rileymat2 8y agoI think “just” is apt. If you have a web request to send the password, you will have a url or username string very close by in memory that can be searched for.
- Xylakant 8y agoI specifically picked an example of a malware that was capable of reading arbitrary files, but not arbitrary memory because the authors found a simple way to trick users into granting them this permission set, but not another. A sandbox escape that allows the attacker to trick the browser into sending arbitrary files back is also substantially different to having malware on your system that can read arbitrary memory.