4 ms·

This reminds me of the fact that Firefox, by default, allows anyone to view stored credentials – no authentication required, as no master password is set. It bo

This reminds me of the fact that Firefox, by default, allows anyone to view stored credentials – no authentication required, as no master password is set. It boggles my mind.

croutonwagon 5y ago
Chrome does they same, at least on windows, if you merely have local admin on the box.
- zamadatix 5y ago
  "if you merely have local admin", yeah the game was lost when you signed on to that machine the first time not when it didn't ask your personal password the Nth time.
lights0123 5y ago
So does Chrome, Edge, and GNOME Web. Safari locks it behind a password prompt, but they can still be extracted one-by-one by using devtools to inspect the value of the password field after being autofilled.
- andreasley 5y ago
  Chrome and derivates require the user's account password to view the stored passwords. Safari uses the macOS keychain and won't show passwords easily. The trick you mentioned only works on Macs without Touch ID and requires more work, so not really the same.
georgyo 5y ago
I was fairly sure that firefox is using your OS keyring. IE, it is encrypted at rest. You logging into your computer unlocks your keyring, which unlocks the secret your browser uses to encrypt things like passwords.... However looking at my keyring on Linux, I see secrets for Chrome, I do not see secrets for firefox... Which I find extremely surprising and disappointing...
graton 5y ago
Firefox at least gives you the option of a master password. Chrome from what I recall has consistently refused to have a master password (on Windows at least).
- gsich 5y ago
  Chrome on Windows uses your user passwords when viewing.
  - LinAGKar 5y ago
    And kwallet/gnome-keyring on Linux. Firefox does not.
Dylan16807 5y ago
If you're logged in then it's on par with just about everything else. If you're not logged in, and you don't encrypt your files, then someone getting access to saved passwords in addition to all your files is worse than just getting access to all your files, but not by a huge amount. If you're not logged in and do encrypt your files then nobody will have access.
beermonster 5y ago
I recall this story: https://www.theguardian.com/technology/2013/aug/07/google-chrome-password-security-flaw https://www.theguardian.com/technology/2013/aug/07/google-ch...

This reminds me of the fact that Firefox, by default, allows anyone to view stored credentials – no authentication required, as no master password is set. It boggles my mind.

croutonwagon 5y ago

Chrome does they same, at least on windows, if you merely have local admin on the box.

zamadatix 5y ago
"if you merely have local admin", yeah the game was lost when you signed on to that machine the first time not when it didn't ask your personal password the Nth time.

lights0123 5y ago

So does Chrome, Edge, and GNOME Web. Safari locks it behind a password prompt, but they can still be extracted one-by-one by using devtools to inspect the value of the password field after being autofilled.

andreasley 5y ago
Chrome and derivates require the user's account password to view the stored passwords. Safari uses the macOS keychain and won't show passwords easily. The trick you mentioned only works on Macs without Touch ID and requires more work, so not really the same.

georgyo 5y ago

I was fairly sure that firefox is using your OS keyring. IE, it is encrypted at rest. You logging into your computer unlocks your keyring, which unlocks the secret your browser uses to encrypt things like passwords.... However looking at my keyring on Linux, I see secrets for Chrome, I do not see secrets for firefox... Which I find extremely surprising and disappointing...

graton 5y ago

Firefox at least gives you the option of a master password. Chrome from what I recall has consistently refused to have a master password (on Windows at least).

gsich 5y ago
Chrome on Windows uses your user passwords when viewing.
- LinAGKar 5y ago
  And kwallet/gnome-keyring on Linux. Firefox does not.

Dylan16807 5y ago

If you're logged in then it's on par with just about everything else. If you're not logged in, and you don't encrypt your files, then someone getting access to saved passwords in addition to all your files is worse than just getting access to all your files, but not by a huge amount. If you're not logged in and do encrypt your files then nobody will have access.

beermonster 5y ago

I recall this story: https://www.theguardian.com/technology/2013/aug/07/google-chrome-password-security-flaw https://www.theguardian.com/technology/2013/aug/07/google-ch...