3 ms·

User access to user settings is not a "security hole". And I don't think there is a way to protect your logged in, unattended session without demolishing produc

User access to user settings is not a "security hole". And I don't think there is a way to protect your logged in, unattended session without demolishing productivity. If you walk away from your computer, lock it. I would expect the State Department to have some protections in place (proximity cards, mandated timeout settings, etc) when actual privileged information is concerned and being accessed. Yes, it would probably be nice if Chrome had the kind of protection of passwords database with a master password that Firefox does. But it still isn't a "security hole".

magicalist 15y ago
Also, as has been written before (and in that chrome bug, I believe), it's trivial to hack the Firefox master password if you are at the physical machine, to say nothing of browser history, account cookies, etc that are stored in the clear. It might be a good UI change, but agreed that it isn't the kind of "security" that the State Department is concerned about.
robomartin 15y ago
How is it not a security hole? Does it not expose critical data with ease? Walking away from an unlocked machine isn't the only scenario that would expose personal login data this way. Also, my post refers to a more general use of Chrome. I would hope that a government installation might have several layers of security on top of any application in order to prevent these holes from being exploited. The "Uncle Pete" example is a very real and plausible scenario. The fact that nearly anything on a computer is hackable isn't the point either. I kind of draw the line at the stage where a precocious ten year old can steal your data while jumping on one foot and whistling the latest Lady Gaga song with one hand tied behind his back and one eye closed. If that doesn't define a security hole I don't know what would.
- politician 15y ago
  As others have pointed out - the problem is not locking your machine when you leave it alone. Suppose that you're using whatever browser that you think does this right, and an adversary gets unencumbered access to the machine because you didn't lock it while you were away. How much protection do you think FireFox or whatever is going to provide relative to the keylogger that is now running on the box? It's not a slam dunk that Chrome would be better if it had a master password anyway given that rarely used passwords tend to be forgotten quickly, and no one wants Chrome to inflict us with some Vista UAC clone. Finally, it's extremely annoying to read hyperbolic comments in which the author responds to criticism by redirecting to some irrelevant corner case viz "my post refers to a more general use of Chrome". If that were really the case, then why "the sky is falling" tone in the original post?
  - robomartin 15y ago
    With Chrome in "civilian" hands by the millions the sky could very well be falling. How many pieces of software on a typical computer hold information that, if it got into the wrong hands, could literally ruin somene's life? For the average Internet user the browser is the only answer. I can't understand why it is that it is wrong to demand at least enough access difficulty to frustrate a smart ten year old. Here's the other problem: Google, as far as I know, does not make the user aware of the potential exposure. This can't be good.
silvestrov 15y ago
There is: KeyChain on OS X does this correctly by encrypting the file and asking for your account password when you want to view a saved password. It might not be 100% hacker safe, but it is 100% employee safe at my workplace, which makes a world of difference.
- robomartin 15y ago
  Right, and the whole office scenario is even scarier than the "Uncle Pete at the computer shop" scenario. In non-techie offices --say, the doctor's office, dentist, the local real-estate shop, whatever-- people don't have a clue about security. And, they have even less of a clue about Chrome being so dangerous. Imagine everyone going out for lunch and leaving their computers unattended (and unlocked). Given that scenario, someone up to no good who stays behind with the express purpose of stealing personal data can have a treasure trove of information by the time everyone is back. And --again, this is my biggest point-- they don't have to be a hacker to do this. All they have to do is point and click and they got everyone's data (and the businesses data as well). It's about time that Google fix this so that it actually requires some skill and effort to steal your data. This is also one of the reasons none of my notebooks have Chrome. Imagine loosing it or having it stolen.
- magicalist 15y ago
  I believe Chrome does use Keychain on OS X. The problem is people click the "always allow" access button the first time Chrome tries to access an already stored password, they enter their password, and then the user isn't prompted anymore. Your passwords are safe and encrypted...Chrome can just display them when it's open because it has access, as the user instructed.
mjwalshe 15y ago
Yes it is if you lose a laptop on a train or in a taxi your fucked - chrome still exposes passwords en clair FS amateur night or what. Of course unless you want to play the oldest trick in the book the "lost despatches trick" (see operation mincemeat for a ww2 example) it might be an advatage :-)

magicalist 15y ago

Also, as has been written before (and in that chrome bug, I believe), it's trivial to hack the Firefox master password if you are at the physical machine, to say nothing of browser history, account cookies, etc that are stored in the clear. It might be a good UI change, but agreed that it isn't the kind of "security" that the State Department is concerned about.

robomartin 15y ago

How is it not a security hole? Does it not expose critical data with ease? Walking away from an unlocked machine isn't the only scenario that would expose personal login data this way. Also, my post refers to a more general use of Chrome. I would hope that a government installation might have several layers of security on top of any application in order to prevent these holes from being exploited. The "Uncle Pete" example is a very real and plausible scenario. The fact that nearly anything on a computer is hackable isn't the point either. I kind of draw the line at the stage where a precocious ten year old can steal your data while jumping on one foot and whistling the latest Lady Gaga song with one hand tied behind his back and one eye closed. If that doesn't define a security hole I don't know what would.

politician 15y ago
As others have pointed out - the problem is not locking your machine when you leave it alone. Suppose that you're using whatever browser that you think does this right, and an adversary gets unencumbered access to the machine because you didn't lock it while you were away. How much protection do you think FireFox or whatever is going to provide relative to the keylogger that is now running on the box? It's not a slam dunk that Chrome would be better if it had a master password anyway given that rarely used passwords tend to be forgotten quickly, and no one wants Chrome to inflict us with some Vista UAC clone. Finally, it's extremely annoying to read hyperbolic comments in which the author responds to criticism by redirecting to some irrelevant corner case viz "my post refers to a more general use of Chrome". If that were really the case, then why "the sky is falling" tone in the original post?
- robomartin 15y ago
  With Chrome in "civilian" hands by the millions the sky could very well be falling. How many pieces of software on a typical computer hold information that, if it got into the wrong hands, could literally ruin somene's life? For the average Internet user the browser is the only answer. I can't understand why it is that it is wrong to demand at least enough access difficulty to frustrate a smart ten year old. Here's the other problem: Google, as far as I know, does not make the user aware of the potential exposure. This can't be good.

silvestrov 15y ago

There is: KeyChain on OS X does this correctly by encrypting the file and asking for your account password when you want to view a saved password. It might not be 100% hacker safe, but it is 100% employee safe at my workplace, which makes a world of difference.

robomartin 15y ago
Right, and the whole office scenario is even scarier than the "Uncle Pete at the computer shop" scenario. In non-techie offices --say, the doctor's office, dentist, the local real-estate shop, whatever-- people don't have a clue about security. And, they have even less of a clue about Chrome being so dangerous. Imagine everyone going out for lunch and leaving their computers unattended (and unlocked). Given that scenario, someone up to no good who stays behind with the express purpose of stealing personal data can have a treasure trove of information by the time everyone is back. And --again, this is my biggest point-- they don't have to be a hacker to do this. All they have to do is point and click and they got everyone's data (and the businesses data as well). It's about time that Google fix this so that it actually requires some skill and effort to steal your data. This is also one of the reasons none of my notebooks have Chrome. Imagine loosing it or having it stolen.
magicalist 15y ago
I believe Chrome does use Keychain on OS X. The problem is people click the "always allow" access button the first time Chrome tries to access an already stored password, they enter their password, and then the user isn't prompted anymore. Your passwords are safe and encrypted...Chrome can just display them when it's open because it has access, as the user instructed.

mjwalshe 15y ago

Yes it is if you lose a laptop on a train or in a taxi your fucked - chrome still exposes passwords en clair FS amateur night or what. Of course unless you want to play the oldest trick in the book the "lost despatches trick" (see operation mincemeat for a ww2 example) it might be an advatage :-)