4 ms·

If I have access to your browser, I can get your credentials for Amazon by just going to Amazon.com. Either you already have a session open, and then I can do w

by neilk 13y ago

If I have access to your browser, I can get your credentials for Amazon by just going to Amazon.com. Either you already have a session open, and then I can do what I want (including changing your password), or the browser (or your password manager) is going to fill in the password automatically, and with a trivial knowledge of how the browser works I can copy the password. I use LastPass, and it is possible to set it so that a master password is required before any password is automatically entered, but in practice no ordinary user can suffer the loss of usability there. Passwords are not actually the thing we are trying to protect. We're trying to protect against a user being able to use your credentials. If they have access to your browser, they have that already. Maybe requiring you to re-enter your login session password, as a pseudo master password, would slow down a really naive attacker. But it will probably also annoy people who just need to get their passwords for some other reason. I would like to hear more from the Chrome team here on their reasoning but I would not be surprised if a 'master' password just leads to more users storing passwords on post-it notes.

manicdee 13y ago
My house has a front door which can be locked. I often leave it unlocked when I am out in the yard (and thus need access through the door on a minute-by-minute basis) or when I have guests over. I side my house I have safes, medicine cabinets and a gun rack. Those things are locked all the time, and I only unlock the cabinet when I need to use the items inside the secure container. So, too, I have a use account login. Sometimes I will hand my computer to a friend (or they sit at the computer, same thing) so they can do stuff. At no point does my friend's physical access to the computer imply that they need access to my bank account details. So those credentials are locked up in 1password to prevent casual theft. Keychain Access and 1password both require a master password to unlock the ability to see stored passwords. The argument about "having physical access negates security" is missing the point: there are different forms of physical access. I won't let visitors plug in random USB, FireWire or Thunderbolt devices for example. They have use of the machine, they have physical access. But if any of them made moves to dunk my computer in liquid nitrogen before removing the RAM, I would shoot them. If the computer is locked, my password safe is locked. If someone steals the computer (or an NSA agent inades my house to freeze and steal the RAM), the key material is encrypted and thus still not accessible to casual inspection. The attitude of "the NSA can break the encryption so it is not even worth hiding things from the visitor casually using your computer" is defeatist. Rethink your assumptions. What are you protecting against? Do I need to switch to a guest account to prevent casual guests from seeing my credentials? How does that aid convenience?
- eirikir 13y ago
  Yes, thank you for explaining this so clearly. Of course I wouldn't knowingly give physical access of my computer to a malicious hacker, but if my friend asks to use it for 60 seconds while I take care of something else, I'd like to be able to do that without logging out and back in as a guest user. Convenience does matter in these kinds of situations, and deleting these "Show" buttons will make it more difficult for the untrained user to pull a prank or worse.
- kumarharsh 13y ago
  Thanks for the precise and lucid argument. I'm so angry right now that I can't even string together my sentences properly :)
elliottkember 13y ago
If I see your password, I can write it down and use it later without you even knowing I was there. That's why we never send passwords in emails. > Maybe requiring you to re-enter your login session password, as a pseudo master password, would slow down a really naive attacker. That's exactly what I'm trying to achieve. It's a real concern for many people. Please show this to a non-technical person and see what they say.
sepinkham 13y ago
Did you test your assertion? Go to amazon right now and try to change your password without having to enter your password first.
- neilk 13y ago
  My browser fills in that password for me. My guess is that would be the same for most people.
  - mbessey 13y ago
    Your browser fills in the "current password" when you try to change your password on amazon.com? How'd you manage that? I have my password saved for amazon, and I don't have to type it to log in, but it doesn't get filled in automatically on the "change password" form (because that'd be stupid).

by neilk 13y ago

manicdee 13y ago

My house has a front door which can be locked. I often leave it unlocked when I am out in the yard (and thus need access through the door on a minute-by-minute basis) or when I have guests over. I side my house I have safes, medicine cabinets and a gun rack. Those things are locked all the time, and I only unlock the cabinet when I need to use the items inside the secure container. So, too, I have a use account login. Sometimes I will hand my computer to a friend (or they sit at the computer, same thing) so they can do stuff. At no point does my friend's physical access to the computer imply that they need access to my bank account details. So those credentials are locked up in 1password to prevent casual theft. Keychain Access and 1password both require a master password to unlock the ability to see stored passwords. The argument about "having physical access negates security" is missing the point: there are different forms of physical access. I won't let visitors plug in random USB, FireWire or Thunderbolt devices for example. They have use of the machine, they have physical access. But if any of them made moves to dunk my computer in liquid nitrogen before removing the RAM, I would shoot them. If the computer is locked, my password safe is locked. If someone steals the computer (or an NSA agent inades my house to freeze and steal the RAM), the key material is encrypted and thus still not accessible to casual inspection. The attitude of "the NSA can break the encryption so it is not even worth hiding things from the visitor casually using your computer" is defeatist. Rethink your assumptions. What are you protecting against? Do I need to switch to a guest account to prevent casual guests from seeing my credentials? How does that aid convenience?

eirikir 13y ago
Yes, thank you for explaining this so clearly. Of course I wouldn't knowingly give physical access of my computer to a malicious hacker, but if my friend asks to use it for 60 seconds while I take care of something else, I'd like to be able to do that without logging out and back in as a guest user. Convenience does matter in these kinds of situations, and deleting these "Show" buttons will make it more difficult for the untrained user to pull a prank or worse.
kumarharsh 13y ago
Thanks for the precise and lucid argument. I'm so angry right now that I can't even string together my sentences properly :)

elliottkember 13y ago

If I see your password, I can write it down and use it later without you even knowing I was there. That's why we never send passwords in emails. > Maybe requiring you to re-enter your login session password, as a pseudo master password, would slow down a really naive attacker. That's exactly what I'm trying to achieve. It's a real concern for many people. Please show this to a non-technical person and see what they say.

sepinkham 13y ago

Did you test your assertion? Go to amazon right now and try to change your password without having to enter your password first.

neilk 13y ago
My browser fills in that password for me. My guess is that would be the same for most people.
- mbessey 13y ago
  Your browser fills in the "current password" when you try to change your password on amazon.com? How'd you manage that? I have my password saved for amazon, and I don't have to type it to log in, but it doesn't get filled in automatically on the "change password" form (because that'd be stupid).