4 ms·

While that's true, they could be placed in secure credential storage instead. The Ripcord chat client for Discord and Slack uses Windows's secure credential sto

While that's true, they could be placed in secure credential storage instead. The Ripcord chat client for Discord and Slack uses Windows's secure credential storage, for example, so I can't easily extract its saved credentials and to clear them I go to the Credential Manager under Control Panel. Mozilla VPN and my GitHub credentials are both in Credential Manager instead of a dotfile as well. The recommendation that a browser is safer seems pretty silly though. As far as I can tell no web browser uses secure credential storage.

deleted 4y ago
[deleted]
tux3 4y ago
This seems like a fundamental problem, if you store a secret locally, you can read it locally. I was skeptical/curious how Windows's Credential Manager could have gotten around that, but Stackexchange says this (https://security.stackexchange.com/a/120001/76848 https://security.stackexchange.com/a/120001/76848): > The Windows Credential Manager is anything but secure. It's "secure" at the user account level, which means that any process that the user ever runs and the user themselves must necessarily be trusted in order to call this system "secure" with a straight face. So this should be about as secure as Chrome or Firefox's storage. A small layer of obfuscation to deter the least motivated script kiddies, but nothing that changes the nature of the problem. If you store secrets under your user account, then programs running under your user account can also read them back.
- yrro 4y ago
  B-b-but the Windows Credential Manager asks me to authenticate before it shows me the value of any saved passwords! It must be secure, right?
- Xylakant 4y ago
  It’s true that protecting against processes running under the users account is hard, but exploiting that would require code execution Accessing a secret in a file does not necessarily. It could be stored on a network share, included in a backup or archive or an attacker could confuse a program into handing them the file. Especially that used to be a very common attack against browsers.
- jwond 4y ago
  While the Windows Credential Manager doesn’t really have any access controls below the user account level, the same is not true for the Mac Keychain. By default if an app tries to read a keychain entry that was created by another app then the user will be prompted to allow or deny access.
yrro 4y ago
What's 'secure credential storage'? I don't think the Windows Credential Management API counts. Any program running as my user can ask for credentials out of the store, can't it? And even if there was such a secure storage location, any program running as my user can read the token out of /proc/<teams PID>/mem; or it can ptrace(2) Teams and extract the token from the communication with the credential storage API...
- ezfe 4y ago
  At least on macOS, the answer is no - a user alert indicating the application is asking to read the credentials will appear with a password field to grant access.
  - magicalhippo 4y ago
    On Windows an application using the Data Protection API can force the decrypt procedure to show a dialog[1]. Though I haven't checked if the dialog is run in a secure context, like for example the UAC dialog is. And I don't know if the dialog contains any information identifying the processing asking. If the dialog is just run in the normal context, or doesn't inform the user who wants to decrypt the data, it's not that useful for thwarting an attack I suppose. [1]: https://docs.microsoft.com/en-us/windows/win32/api/dpapi/ns-dpapi-cryptprotect_promptstruct https://docs.microsoft.com/en-us/windows/win32/api/dpapi/ns-...

deleted 4y ago

[deleted]

tux3 4y ago

This seems like a fundamental problem, if you store a secret locally, you can read it locally. I was skeptical/curious how Windows's Credential Manager could have gotten around that, but Stackexchange says this (https://security.stackexchange.com/a/120001/76848 https://security.stackexchange.com/a/120001/76848): > The Windows Credential Manager is anything but secure. It's "secure" at the user account level, which means that any process that the user ever runs and the user themselves must necessarily be trusted in order to call this system "secure" with a straight face. So this should be about as secure as Chrome or Firefox's storage. A small layer of obfuscation to deter the least motivated script kiddies, but nothing that changes the nature of the problem. If you store secrets under your user account, then programs running under your user account can also read them back.

yrro 4y ago
B-b-but the Windows Credential Manager asks me to authenticate before it shows me the value of any saved passwords! It must be secure, right?
Xylakant 4y ago
It’s true that protecting against processes running under the users account is hard, but exploiting that would require code execution Accessing a secret in a file does not necessarily. It could be stored on a network share, included in a backup or archive or an attacker could confuse a program into handing them the file. Especially that used to be a very common attack against browsers.
jwond 4y ago
While the Windows Credential Manager doesn’t really have any access controls below the user account level, the same is not true for the Mac Keychain. By default if an app tries to read a keychain entry that was created by another app then the user will be prompted to allow or deny access.

yrro 4y ago

What's 'secure credential storage'? I don't think the Windows Credential Management API counts. Any program running as my user can ask for credentials out of the store, can't it? And even if there was such a secure storage location, any program running as my user can read the token out of /proc/<teams PID>/mem; or it can ptrace(2) Teams and extract the token from the communication with the credential storage API...

ezfe 4y ago
At least on macOS, the answer is no - a user alert indicating the application is asking to read the credentials will appear with a password field to grant access.
- magicalhippo 4y ago
  On Windows an application using the Data Protection API can force the decrypt procedure to show a dialog[1]. Though I haven't checked if the dialog is run in a secure context, like for example the UAC dialog is. And I don't know if the dialog contains any information identifying the processing asking. If the dialog is just run in the normal context, or doesn't inform the user who wants to decrypt the data, it's not that useful for thwarting an attack I suppose. [1]: https://docs.microsoft.com/en-us/windows/win32/api/dpapi/ns-dpapi-cryptprotect_promptstruct https://docs.microsoft.com/en-us/windows/win32/api/dpapi/ns-...