2 ms·
Interesting find. This should apply to any online password manager, though. Shouldn't this apply even to sites like LastPass? Or anything where your master pass
by harikb 6y ago
Interesting find. This should apply to any online password manager, though. Shouldn't this apply even to sites like LastPass? Or anything where your master password is entered via a "3rd party" software (browser in this case). I am excluding 1password or anything with a standalone desktop software. But the browser-plugin for your password manager could be just as bad attack vector.
- jiofih 6y agoStoring your master password anywhere is an obvious fuckup. The story here is that just by having a valid session you can export all passwords from google password manager without it ever asking for authentication.
- gundmc 6y agoSmall correction - it asks for your device password (try it yourself if you use the chrome password manager). In this case something with NoMachine exposed/disabled the device password as well. Essentially the OP's configuration allowed an attacker unfettered access to the machine while a "blessed" chrome session was still active and had their master password stored in Safari.
- fasterthanlime 6y agoIf you view passwords in Google Chrome, it asks for the device password. If you view them from the online Google Passwords Manager website, it doesn't ask for the device password (how would it?).