4 ms·
I'm not an expert so I'm just gonna ask the question. How is this different than what my web browsers do with all the passwords they memorize for me? They are s
by Lendal 7y ago
I'm not an expert so I'm just gonna ask the question. How is this different than what my web browsers do with all the passwords they memorize for me? They are stored locally, and encrypted, not hashed, with a key that is hard-coded somewhere. Right?
- DuskStar 7y agoWell, the key isn't hardcoded in the browser implementation. (It's unique per-install) And I think browsers generally do a better job using OS security mechanisms to restrict access to that key, too.
- xxs 7y agoBrowser have no other choice - but if you control the server and the client - there are ==a lot== better mechanism to store auth. info.
- sdinsn 7y agoNo- Chrome actually uses the Windows DPAPI, which encrypts passwords using your user login credentials. 3rd party password managers use a master password with a PBKDF.
- arsome 7y agoIt's still absolutely trivial to dump these though. Especially in the case of Chrome. iStealer is a classic script kiddie tool designed to exploit this.
- kakwa_ 7y agoIIRC, in the case of firefox, a key is generated at profile creation, and then the password saved are encrypted using this key. It's basically security through obscurity as the key stays clear text UNLESS the profile is protected by a password a human must type every times he opens Firefox.