3 ms·

Slightly off topic, but it really bugs me that Chrome has security researchers busy analyzing hypothetical attacks, but refuses to do anything to prevent practi

by jwegan 15y ago

Slightly off topic, but it really bugs me that Chrome has security researchers busy analyzing hypothetical attacks, but refuses to do anything to prevent practical real world attacks. My 5 year old cousin can find out all my saved passwords if given 10 seconds to access my laptop while I go to the bathroom by going to preferences->personal stuff->managed saved passwords->and clicking show when hovering over an obscured password. Firefox and IE, have had the ability to require a master password to reveal saved passwords in the password manager for years. Sure it isn't secure against a sophisticated attacker, but at least 99% of the world's population probably couldn't figure out how to break it, much less my 5 year old cousin.

cmelbye 15y ago
Whoa... Thank you for alerting me to that, I just deleted all my saved passwords. That's absolutely insane.
- TylerE 15y ago
  A malicious attacker with 30 seconds on your machine unobserved could just keylog you.
magicalist 15y ago
er, that sounds exactly what you would expect from a security researcher :) More seriously, these are certainly not hypothetical attacks (the DigiNotar thing was just a few months ago), and the fact that that "1%" can figure out how to see your passwords just by googling "master password firefox" shows exactly why this isn't a security issue (in some strict sense). You could certainly make it slightly harder to see them than clicking a few buttons (with the same reasoning you put a confirmation dialog before someone deletes their life's work), but there are good arguments on both sides about the utility of that kind of security theater. This doesn't work for everyone, but I personally set up a guest account on my computer and enable fast user switching. I can worry a lot less about multiple aspects of my 5 year old cousin using my computer, then.
hokkos 15y ago
Use LastPass, don't save passwords with Chrome.
DanBC 15y ago
Use a screen lock.
lloeki 15y ago
On OSX Chrome relies on the system Keychain so it's protected against that case. I don't know if it can be made to use the Gnome Keyring (or its KDE counterpart). Out of curiosity does anything like those keychains (I mean a theoretically secure storage area for authentication tokens available to developers and manageable by users) exists on Windows systems?
- acdha 15y ago
  Windows has had a secure storage system for a long time (http://msdn.microsoft.com/en-us/library/ms995355 http://msdn.microsoft.com/en-us/library/ms995355) but, unsurprisingly, many developers chose not to use it and there were limited tools for interacting with it in the base install.

by jwegan 15y ago

cmelbye 15y ago

Whoa... Thank you for alerting me to that, I just deleted all my saved passwords. That's absolutely insane.

TylerE 15y ago
A malicious attacker with 30 seconds on your machine unobserved could just keylog you.

magicalist 15y ago

er, that sounds exactly what you would expect from a security researcher :) More seriously, these are certainly not hypothetical attacks (the DigiNotar thing was just a few months ago), and the fact that that "1%" can figure out how to see your passwords just by googling "master password firefox" shows exactly why this isn't a security issue (in some strict sense). You could certainly make it slightly harder to see them than clicking a few buttons (with the same reasoning you put a confirmation dialog before someone deletes their life's work), but there are good arguments on both sides about the utility of that kind of security theater. This doesn't work for everyone, but I personally set up a guest account on my computer and enable fast user switching. I can worry a lot less about multiple aspects of my 5 year old cousin using my computer, then.

hokkos 15y ago

Use LastPass, don't save passwords with Chrome.

DanBC 15y ago

Use a screen lock.

lloeki 15y ago

On OSX Chrome relies on the system Keychain so it's protected against that case. I don't know if it can be made to use the Gnome Keyring (or its KDE counterpart). Out of curiosity does anything like those keychains (I mean a theoretically secure storage area for authentication tokens available to developers and manageable by users) exists on Windows systems?

acdha 15y ago
Windows has had a secure storage system for a long time (http://msdn.microsoft.com/en-us/library/ms995355 http://msdn.microsoft.com/en-us/library/ms995355) but, unsurprisingly, many developers chose not to use it and there were limited tools for interacting with it in the base install.