23 ms·

Showing stored passwords – Tim Berners-Lee

178 points by jchrisa 13y ago

adsche 13y ago
The tweet: https://twitter.com/timberners_lee/status/364839351651274752 https://twitter.com/timberners_lee/status/364839351651274752
MichaelGG 13y ago
News: If you have root on modern Linux distro, you can edit the sudoers file. Requesting a password would provide a false sense of security. The passwords are stored in an easily obtainable format. If you are leaving your laptop around untrusted people, you're going to have problems. Trying to draw a line around the secure point (having a workstation totally unlocked) sounds incorrect.
- dgesang 13y ago
  The passwords are stored in an easily obtainable format. So, why not change THAT and store them encrypted with a master key? If you are leaving your laptop around untrusted people, you're going to have problems. True. But why make it even easier for someone unauthorized to retrieve your passwords? Why is it only the browser developers who come up with that arguement? I've never read such a statement from any other team. And why aren't other software systems do it that way if it is so insecure and "falce-security" so encrypt user passwords in a local db? Couldn't even an OS use that argument and say "hey, you got physical access to the system, here are all the passwords in plain text, have fun!".
  - MichaelGG 13y ago
    >So, why not change THAT and store them encrypted with a master key? They are; it's called your user account password. If you mean an extra password, the answer is that most people don't want to type in a password when they open their browser. And even if they did, then the argument would be "well they leave their browsers open, so it should ask for a password every time", which defeats the whole purpose of password saving. Think it through and try to see the issue.
    - andreasvc 13y ago
      You drew an analogy with having root and being able to edit the sudoers file, but note that in that case the attacker is not able to see any passwords, only change them. I think it provides a useful level of security if the browser would encrypt stored passwords with a master key, using an OS-provided keychain. As with Safari, it could then ask for the master password before showing any passwords, while remembering the same password for normal logins for convenience. This is under the assumption that revealing your password is worse than somebody being able to use your accounts.
      - MichaelGG 13y ago
        Please explain the exact algorithm that the browser stores encrypted passwords and needs a master password before showing, but can "remember for convenience". Or do you mean that it'll prompt people for a master password for uncommonly used sites? Because that's just going to lead to people forgetting the master password and having to do a password reset.
        andreasvc 13y ago
        My suggestion would be to use the OS keychain facilities, so the master password would be the same as the one used to log in. The master password is only needed once to decrypt the passwords, but I'm suggesting that for the 'show passwords' functionality the browser should insist on asking the password again. The advantage is that on disk, passwords are not stored in plaintext, and the browser doesn't reveal passwords trivially. A determined attacker could still extract the encryption key from a memory dump, but that's on a completely different level from a "show passwords" button.
        makomk 13y ago
        Chrome already uses the OS keychain facilities. People are complaining that this is insecure because unauthorized people can look at the saved passwords if the user leaves their computer logged in and unlocked. They want Chrome to adopt the Firefox approach of storing them directly on disk optionally encrypted with a master password.
- deleted 13y ago
  [deleted]
sirsar 13y ago
It's similar to changing your ssh port: does it provide "real" security? No. Does it prevent the majority of automated attacks? Absolutely. As a real world analogy, what about easily-climbable fences? Those are often a useful deterrent, and they make trespassing litigation more likely to succeed. [1] http://rimuhosting.com/knowledgebase/linux/misc/preventing-brute-force-ssh-attacks http://rimuhosting.com/knowledgebase/linux/misc/preventing-b... [2] http://serverfault.com/questions/189282/why-change-default-ssh-port http://serverfault.com/questions/189282/why-change-default-s...
- MichaelGG 13y ago
  Automated attacks will rapidly adapt. There's zero barrier without some OS-provided sandbox mechanism. For instance, something that verifies the signer of the executable before providing a key. (That doesn't exist on Windows, for example.)
  - joshka 13y ago
    I read an article recently that suggested that automated attacks of ssh on non standard ports have already adapted, hence this already offers no extra security.
denzil_correa 13y ago
I read Justin Schuh (head of Chrome Security) comments [0] and I was a bit taken aback. He seems to suggest that unless you get 100% security it is no point making it tough for an attacker to steal passwords. For example, if you are not 100% sure of your home being theft proof - please do not worry about locking up your doors! :) [0] https://news.ycombinator.com/item?id=6167146 https://news.ycombinator.com/item?id=6167146
- HCIdivision17 13y ago
  The response is fairly shocking. I have always felt reassured that security gurus will argue about minutiae in encryption schemes just because someday someone may figure out a piece of mathemagic that bypasses it. Here we have a response from a security head that it's silly to try to be secure if the person has physical access, or at least the Chrome team can't trust anyone else's app. What if you leave your desk for the bathroom and forget to lock it? Or put chrome on a flash drive? Or have settings stored in a non-default location? Or heaven forbid a clever virus manages to get on and all it does is try to look at passwords?
  - MichaelGG 13y ago
    Your what if scenarios are essentially game over. "Heaven forbid a virus" - uh, if an attacker is running arbitrary code in your security context, you've lost. Full stop. Leave your desk and forget to lock it? Uh, then anyone that sits down keeps your user sessions. Unless you've configured things to prompt for passwords everywhere (like Vista UAC) then they have access to plaintexts you would. Users aren't going to want to type in a password every time they open their browser. Non-sandboxed OSes can't really enforce any security there. And users hate re-entering passwords, this is why they are saving passwords in the first place. You're arguing "yeah, but just because I logged in as root doesn't mean I want to be able to run root commands". His response is correct.
    - ronaldx 13y ago
      Tim Berners-Lee is correct. If I leave my desk to go to the bathroom for a few minutes then I take my chances with any malicious actors with access to my hardware, sure, we can call that "game over". But that scenario doesn't make much sense in reality - if someone is that close and has such a malicious intent, why don't they simply hit me with a 5 dollar wrench[0]? Whoever happens to be feeling malicious in my office ought to have to act out their malice deliberately - and not simply to be able to click a single button to retrieve all my personal passwords. [0] http://xkcd.com/538/ http://xkcd.com/538/
pbreit 13y ago
I'm sick of the crypto "experts" equating weak (or even "pretty strong") security with no security.
- jchrisa 13y ago
  Thanks. This is why I posted this. Not everyone's office is full of kernel hackers. In real life, most security is grey.
revelation 13y ago
Looks and feels like a bikeshed. This kind of obfuscation will only lead to more Linus rants of how his kids need root access to install a printer.
Sidnicious 13y ago
I made this argument to the 1Password guys (Dave Teare, I think) when I ran into them at Macworld a few years ago. I was used to the Mac OS's keychain always asking for a password to see or edit its contents, even when it's unlocked and apps can get at their stuff in it at will. 1Password doesn't. He made the same counter-argument, that if you handing over your computer over to someone you don't trust, 1Password should be locked — his locks after a short timeout and whenever he put his computer to sleep. These arguments are way more eloquent than mine though.
spinchange 13y ago
The purpose of a master password is not to provide perfect security or a false sense thereof. The purpose is to impede an unskilled attacker who has only momentary access (like the amount of time it takes to type chrome://settings/passwords on a temporarily unattended machine) and mitigate the severity of what can be done by an unskilled attacker in the event of such a short breach. It might be proper security engineering practice, but it strikes me as being totally out-of-touch with regular humans and mere mortal users to insist that once any attacker has access for any duration, you're completely hosed anyway, so why not make it easy for them.
- dgesang 13y ago
  This! The assumption that some uber-1337-hax0r is accessing the system who will install a rootkit just by looking at it is just not close to reality. It is on the other hand a very real situation that some weird friends, family members or co-workers have access to your system while you're not looking.
- Dylan16807 13y ago
  An unskilled attacker with no knowledge won't know where to go to get the passwords. An unskilled attacker with instructions can type in a url to get a password dumper, and be in and out in 30 seconds plus memorization/transcription time.
  - Ovid 13y ago
    A little brother using Chrome regularly won't know about keyloggers, how to write a clever bookmarklet, or even be allowed to be around when his big sister is typing in her password. But there's a good chance he does know about clicking that little icon, choosing "settings", and seeing all of his big sister's passwords when she's out on a date and forgot to lock her computer. Locks on your front door knob are not there to keep out burglars. They're there to prevent opportunistic crime: someone who tries that doorknob out of curiosity and discovers a home full of stuff and no one around. There's a large middle ground between good guys, bad guys, and those who might, just might, be tempted to be bad when they find that suitcase full of money. That's what Google is missing here. And in a condescending response[1], someone who is allegedly the Google head of Chrome security called the original author a "novice", claimed Google has "quite a bit of data" to back up their case (without describing the data, its source, or how it was evaluated), and suggested that a master password would make security worse by providing a false sense of security. First, I would suggest that if Google really does have the data mentioned in the claim, release it. Second, a master password isn't going to make the computer safer from a determined black hat because physical access to the machine means game over, but THE MASTER PASSWORD IS NOT ABOUT PROTECTION FROM BLACK HATS. When the colleague who hates you is standing by your unlocked computer when you're off to get coffee and suddenly realizes that he not only can read your email now, but at any time he wants to in the future, that's a problem — when your partner gets suspicious about your working long and you've forgotten to log out — when your little brother realizes he can post "funny" pictures to your Facebook page ... when, when, when ... there are so many areas where this could cause a lot of pain. For example, this is from a blog entry I wrote a decade ago about a young lady who was compromised because LiveJournal stored her username in the cookie and the conservative, religious parents found her blog[2]: I know of a young lady who kept an online journal. Her parents found it and started reading it and were horrified to find out that she was suffering from -- brace yourself -- teen angst! Her parents don't understand her, not enough boys like her, she's not very popular, etc., etc. In reading through the journal, there are no references to doing drugs, sex, or anything else that one might expect a parent to worry about, but this young lady's parents hit the roof. They forbid her to keep an online journal and they grounded her (naturally, I'm sure this cured the angst problem). The parents had physical access to the computer and were smart enough to look at cookie data (these parents weren't technically sophisticated, I might add). Can you imagine what would have happened if the parents could then have read all of their daughter's passwords? Google telling users "this isn't really secure, so we're not going to do a damn thing to help you" doesn't help. Google is optimizing against black hats but pretending that opportunistic crime doesn't exist. In physical security, opportunistic criminals tend not to be the brightest or think too deeply about what they're doing, but when the opportunity is there, they go for. Google is happy to give them that opportunity. 1. https://news.ycombinator.com/item?id=6166953 https://news.ycombinator.com/item?id=6166953 2. http://use.perl.org/use.perl.org/_Ovid/journal/13471.html http://use.perl.org/use.perl.org/_Ovid/journal/13471.html
jellicle 13y ago
And this is why I don't use Chrome, nor recommend it to anyone. The dimwit Chrome developers continue their dumb insistence that penetrable security shouldn't exist. "Bathroom doors shouldn't have locks; someone could just kick the door in and then where would you be!" "Houses shouldn't have locks; you've got glass windows, don't you?! It's a false sense of security!" "Prisons shouldn't have 20-foot walls; Home Depot has 21 foot ladders, don't they?! Lex Luthor escaped via helicopter! It's a false sense of security!" "Bicycles shouldn't have locks; there are bolt cutters with five-foot handles, aren't there?! It's a false sense of security!" Of course in the real world, where Chrome developers do not live, we use locks in all these cases. There's a combination of social signalling (this is mine; do not disturb it) as well as legal signalling (locked means an affirmative action must be taken to break the security, which is punishable; unlocked is not punishable) as well as a substantial amount of actual security (the reality is not everyone carries five-foot bolt cutters, even if some people do). Maybe I can put it another way: Android, up through 4.2, only contemplated a single user per tablet. So if you gave your kids (or anyone) the tablet to play with, they had FULL and unrestricted access to your Gmail account, Google Play account, and so on. Someone, eventually, slapped some sense into the Android developers and now Android 4.3 has restricted profiles where you can let the kids play games without giving them access to your Google accounts. That someone needs to get their slapping gloves and wander over to the Chrome development team...
- skymt 13y ago
  I think it comes down to how the Chrome team is used to thinking about security. Most of Chrome's security work, such as the phishing blacklist and the process sandbox, aims to prevent attacks from malicious web pages. In those circumstances, "pretty good" security gets you nowhere. If there's a difficult but known way to break the sandbox and execute arbitrary code, it needs to be patched. Otherwise, the hole's obscurity won't prevent people from distributing exploit kits. A subtly broken sandbox is almost exactly as secure as no sandbox at all. If you're accustomed to thinking of security in this all-or-nothing way, the Chrome team's argument makes sense. And the state of the Internet encourages this kind of thinking. In the real world there are plenty of gray areas to security, but online there's always a sufficiently advanced and determined attacker.
- 13y ago
comex 13y ago
I suppose the issue here is that many of the people who might "compromise" one's browsing session don't fit the model of an evil attacker. They might be friendly pranksters, or unfriendly but not invested enough in the "attack" to go to much effort to perform it. Part of the reason it makes a difference, as noted, is most people's lack of technical knowledge, which might not be a good thing to rely on (though it will probably continue to exist for the foreseeable future), but even with the knowledge that alternatives exist, it feels more evil to go after them. In computer security, it's common to look down on security measures that are bypassable, even if they have some deterrent effect, because hackers wise up fast, and the false sense of security the measures tend to provide is actively harmful. But there's a difference between hackers and the general population... The other comment in this thread about locking doors is a good analogy. The chance that locking my door (in a house with many ground-floor windows and no home security system) will deter an actual burglar is nil. But it could certainly deter some strange neighbor from sneaking in and perhaps stealing things. on the other hand - justinschuh mentioned that they've "literally spent years evaluating it and have quite a bit of data to inform our position". Opinions formed off the top of our heads don't mean that much.
rbobby 13y ago
It seems that an undifferentiated threat model is being used. Within the scope of physical access to an unlocked device all attackers are considered to be ultimately sophisticated and absolutely untrustworthy. This model is clearly lacking, and is not appropriate for software as widely deployed as Chrome.
kefs 13y ago
Relevant reading: http://raidersec.blogspot.in/2013/06/how-browsers-store-your-passwords-and.html http://raidersec.blogspot.in/2013/06/how-browsers-store-your... Also, if you're on FF, do yourself a favour and turn on a master password before it's too late (Tools > Settings > Security).
laureny 13y ago
Why is it so hard for the Chrome team to realize how harmful it is to see passwords in clear text without any effort on the part of the intruder. Baffling to me really, especially coming from Google. They are going to turn around on this, I am certain of it, but why it's taking them so long is beyond me.
CoryG89 13y ago
I've often thought that it was strange that these passwords were stored in plain text. Although. At least with the version of Firefox my old workplace had on their machines, I was able to view all the passwords stored in it as well. Not sure if this has been fixed, but at least it's not always been just Chrome guilty of this.
- johnpowell 13y ago
  Just checked with latest FF on OS 10.8.4. Click a button and you can see all of them. Safari will prompt for a password.
  - neilparikh 13y ago
    Firefox allows you set a master password, which will hide stored passwords and not allow you to access them until you enter the master password. I think this also encrypts the stored passwords, but I'm not sure about that.
cheald 13y ago
Something I've found rather silly in this whole kerfluffle is a failure to recognize that a physical-access attacker can just as easily copy your Chrome/Firefox/whatever profile to a thumb drive, and he now has a full copy of all of your login cookies, many of which are going to permit bypass of 2FA. I like the idea of there being a challenge in Chrome before my passwords are displayed, but its actual impact on actual security is pretty negligible.
- bookface 13y ago
  I disagree. Maybe if anybody who would ever have physical access to your computer has the technical chops of the average HN commenter, it wouldn't do much for you. However, for somebody leaving their computer alone for a few minutes in a coffee shop or college library, this could definitely deter many opportunists.
  - cheald 13y ago
    I...just said that I favor Chrome having a challenge before displaying passwords. I also said that I agree with the Chrome team's position that it doesn't substantially improve security against a physical attacker. I'd like Chrome to have it, but I also know that having your passwords behind a master password doesn't actually result in your web-based accounts being secured against a physical attacker. A challenge dialog is going to deter the "casual" snoop. I'm all for it as a defense-in-depth measure. My point is that you can encrypt your passwords all you want, but even in that case, physical access is game over because there are additional attack vectors that don't require a passphrase to breach. And honestly, if I left my computer alone in a coffee shop or library, I'd be much more worried that someone would pick it up and walk off with it than that someone is going to look at my Chrome passwords. Good luck memorizing those 16-character randomly-generated phrases that I can't reliably remember after two months of repeated use.
    - interpol_p 13y ago
      > A challenge dialog is going to deter the "casual" snoop. I think the "casual" snoop is far more likely than the determined attacker with physical access. Which is why the Chrome team's position on this is baffling. There are so many cases where I hand my computer over to coworkers, friends, family. I trust them all not to explicitly circumvent the security of my machine, but I definitely don't trust some of them not to "casually snoop."
abalone 13y ago
Are these supposed security experts completely ignorant about how Mac OSX Keychain works? This is the basis of much of the argument in favor of Chrome's approach: >In all cases, if you have access to the machine, all it takes is trivial software that's widely available to snoop on anyone else using the machine. This has been repeated elsewhere including by the Chrome security engineer in so many words. Paraphrasing, "if you've got physical access to the machine, everything else is just theater, so we just go ahead and make that obvious." But.... OSX requires the admin password before installing any software. That would seem to invalidate the above argument. Or is there actually a way to bypass OSX Keychain.. and if so how "trivial" is it? Certainly nothing comes up in a quick google search. You'd think it'd be big news, that Apple's whole security framework is just "theater".
- ZeroGravitas 13y ago
  I'm fairly sure that I've installed (and run) Mac OS X apps via drag and drop with no admin prompt.
  - abalone 13y ago
    Hmm, maybe it's just the System and root Library folders that require authentication. But those would be what you'd need to access to install a keylogger or some such monitoring software, I'd guess.
- makomk 13y ago
  Chrome already uses the OSX Keychain to store passwords. Firefox, on the other hand, stores them as plaintext unless you find and use the option to set a master password.
  - abalone 13y ago
    That's kind of beside the point. While Chrome may store passwords encrypted via Keychain, the problem is it readily displays them to the user via its UI without any re-authentication. Its creators think that any attempts to authenticate users beyond the system login are "theater". Is this really true for OS X Keychain? Are its admin password prompts for actions like installing system components or displaying secrets in the UI just theater?
eli 13y ago
Sounds like the debate over running SSH on a nonstandard port. Sure, it provides only a little protection and only against opportunistic, drive-by attacks... but it's easy to do and it can't hurt. So why not?
deleted 13y ago
[deleted]
ColinWright 13y ago
This hit the news three weeks ago. Here's a submission with 305 comments, including a reply from the Chrome browser security tech lead: https://news.ycombinator.com/item?id=6165708 https://news.ycombinator.com/item?id=6165708 Here are some other submission: https://news.ycombinator.com/item?id=6167331 https://news.ycombinator.com/item?id=6167331 https://news.ycombinator.com/item?id=6171813 https://news.ycombinator.com/item?id=6171813 (many comments) https://news.ycombinator.com/item?id=6171979 https://news.ycombinator.com/item?id=6171979 https://news.ycombinator.com/item?id=6173106 https://news.ycombinator.com/item?id=6173106 (many comments) https://news.ycombinator.com/item?id=6173582 https://news.ycombinator.com/item?id=6173582 https://news.ycombinator.com/item?id=6175012 https://news.ycombinator.com/item?id=6175012 https://news.ycombinator.com/item?id=6177417 https://news.ycombinator.com/item?id=6177417 https://news.ycombinator.com/item?id=6180711 https://news.ycombinator.com/item?id=6180711
7952 13y ago
If the password submission was handled in javascript couldn't the website rewrite the password field with a one time password. This would let people use password storage, but give the ability to revoke later on. The only difference between a stored password and a cookie, is that cookies are trusted less. Both can give password equivalent access.
CamperBob2 13y ago
I don't get the controversy. There are very few reasons to have multiple user accounts on a home PC, but this sounds like one of them. If you want to lend your PC to someone or allow other friends/family members to access it at will, you need to create separate user accounts for those people. Problem solved.
bonaldi 13y ago
Not sure why "you can just use the DOM inspector" is so often accepted without question. Why does the DOM inspector happily show you a password? Shouldn't the browser be keeping track of those it has autofilled and prompting for a password before exposing them there, too?

178 points by jchrisa 13y ago

The tweet: https://twitter.com/timberners_lee/status/364839351651274752 https://twitter.com/timberners_lee/status/364839351651274752

MichaelGG 13y ago

News: If you have root on modern Linux distro, you can edit the sudoers file. Requesting a password would provide a false sense of security. The passwords are stored in an easily obtainable format. If you are leaving your laptop around untrusted people, you're going to have problems. Trying to draw a line around the secure point (having a workstation totally unlocked) sounds incorrect.

dgesang 13y ago
The passwords are stored in an easily obtainable format. So, why not change THAT and store them encrypted with a master key? If you are leaving your laptop around untrusted people, you're going to have problems. True. But why make it even easier for someone unauthorized to retrieve your passwords? Why is it only the browser developers who come up with that arguement? I've never read such a statement from any other team. And why aren't other software systems do it that way if it is so insecure and "falce-security" so encrypt user passwords in a local db? Couldn't even an OS use that argument and say "hey, you got physical access to the system, here are all the passwords in plain text, have fun!".
- MichaelGG 13y ago
  >So, why not change THAT and store them encrypted with a master key? They are; it's called your user account password. If you mean an extra password, the answer is that most people don't want to type in a password when they open their browser. And even if they did, then the argument would be "well they leave their browsers open, so it should ask for a password every time", which defeats the whole purpose of password saving. Think it through and try to see the issue.
  - andreasvc 13y ago
    You drew an analogy with having root and being able to edit the sudoers file, but note that in that case the attacker is not able to see any passwords, only change them. I think it provides a useful level of security if the browser would encrypt stored passwords with a master key, using an OS-provided keychain. As with Safari, it could then ask for the master password before showing any passwords, while remembering the same password for normal logins for convenience. This is under the assumption that revealing your password is worse than somebody being able to use your accounts.
    - MichaelGG 13y ago
      Please explain the exact algorithm that the browser stores encrypted passwords and needs a master password before showing, but can "remember for convenience". Or do you mean that it'll prompt people for a master password for uncommonly used sites? Because that's just going to lead to people forgetting the master password and having to do a password reset.
      - andreasvc 13y ago
        My suggestion would be to use the OS keychain facilities, so the master password would be the same as the one used to log in. The master password is only needed once to decrypt the passwords, but I'm suggesting that for the 'show passwords' functionality the browser should insist on asking the password again. The advantage is that on disk, passwords are not stored in plaintext, and the browser doesn't reveal passwords trivially. A determined attacker could still extract the encryption key from a memory dump, but that's on a completely different level from a "show passwords" button.
        makomk 13y ago
        Chrome already uses the OS keychain facilities. People are complaining that this is insecure because unauthorized people can look at the saved passwords if the user leaves their computer logged in and unlocked. They want Chrome to adopt the Firefox approach of storing them directly on disk optionally encrypted with a master password.
deleted 13y ago
[deleted]

sirsar 13y ago

It's similar to changing your ssh port: does it provide "real" security? No. Does it prevent the majority of automated attacks? Absolutely. As a real world analogy, what about easily-climbable fences? Those are often a useful deterrent, and they make trespassing litigation more likely to succeed. [1] http://rimuhosting.com/knowledgebase/linux/misc/preventing-brute-force-ssh-attacks http://rimuhosting.com/knowledgebase/linux/misc/preventing-b... [2] http://serverfault.com/questions/189282/why-change-default-ssh-port http://serverfault.com/questions/189282/why-change-default-s...

MichaelGG 13y ago
Automated attacks will rapidly adapt. There's zero barrier without some OS-provided sandbox mechanism. For instance, something that verifies the signer of the executable before providing a key. (That doesn't exist on Windows, for example.)
- joshka 13y ago
  I read an article recently that suggested that automated attacks of ssh on non standard ports have already adapted, hence this already offers no extra security.

denzil_correa 13y ago

I read Justin Schuh (head of Chrome Security) comments [0] and I was a bit taken aback. He seems to suggest that unless you get 100% security it is no point making it tough for an attacker to steal passwords. For example, if you are not 100% sure of your home being theft proof - please do not worry about locking up your doors! :) [0] https://news.ycombinator.com/item?id=6167146 https://news.ycombinator.com/item?id=6167146

HCIdivision17 13y ago
The response is fairly shocking. I have always felt reassured that security gurus will argue about minutiae in encryption schemes just because someday someone may figure out a piece of mathemagic that bypasses it. Here we have a response from a security head that it's silly to try to be secure if the person has physical access, or at least the Chrome team can't trust anyone else's app. What if you leave your desk for the bathroom and forget to lock it? Or put chrome on a flash drive? Or have settings stored in a non-default location? Or heaven forbid a clever virus manages to get on and all it does is try to look at passwords?
- MichaelGG 13y ago
  Your what if scenarios are essentially game over. "Heaven forbid a virus" - uh, if an attacker is running arbitrary code in your security context, you've lost. Full stop. Leave your desk and forget to lock it? Uh, then anyone that sits down keeps your user sessions. Unless you've configured things to prompt for passwords everywhere (like Vista UAC) then they have access to plaintexts you would. Users aren't going to want to type in a password every time they open their browser. Non-sandboxed OSes can't really enforce any security there. And users hate re-entering passwords, this is why they are saving passwords in the first place. You're arguing "yeah, but just because I logged in as root doesn't mean I want to be able to run root commands". His response is correct.
  - ronaldx 13y ago
    Tim Berners-Lee is correct. If I leave my desk to go to the bathroom for a few minutes then I take my chances with any malicious actors with access to my hardware, sure, we can call that "game over". But that scenario doesn't make much sense in reality - if someone is that close and has such a malicious intent, why don't they simply hit me with a 5 dollar wrench[0]? Whoever happens to be feeling malicious in my office ought to have to act out their malice deliberately - and not simply to be able to click a single button to retrieve all my personal passwords. [0] http://xkcd.com/538/ http://xkcd.com/538/

pbreit 13y ago

I'm sick of the crypto "experts" equating weak (or even "pretty strong") security with no security.

jchrisa 13y ago
Thanks. This is why I posted this. Not everyone's office is full of kernel hackers. In real life, most security is grey.

revelation 13y ago

Looks and feels like a bikeshed. This kind of obfuscation will only lead to more Linus rants of how his kids need root access to install a printer.

Sidnicious 13y ago

I made this argument to the 1Password guys (Dave Teare, I think) when I ran into them at Macworld a few years ago. I was used to the Mac OS's keychain always asking for a password to see or edit its contents, even when it's unlocked and apps can get at their stuff in it at will. 1Password doesn't. He made the same counter-argument, that if you handing over your computer over to someone you don't trust, 1Password should be locked — his locks after a short timeout and whenever he put his computer to sleep. These arguments are way more eloquent than mine though.

spinchange 13y ago

The purpose of a master password is not to provide perfect security or a false sense thereof. The purpose is to impede an unskilled attacker who has only momentary access (like the amount of time it takes to type chrome://settings/passwords on a temporarily unattended machine) and mitigate the severity of what can be done by an unskilled attacker in the event of such a short breach. It might be proper security engineering practice, but it strikes me as being totally out-of-touch with regular humans and mere mortal users to insist that once any attacker has access for any duration, you're completely hosed anyway, so why not make it easy for them.

dgesang 13y ago
This! The assumption that some uber-1337-hax0r is accessing the system who will install a rootkit just by looking at it is just not close to reality. It is on the other hand a very real situation that some weird friends, family members or co-workers have access to your system while you're not looking.
Dylan16807 13y ago
An unskilled attacker with no knowledge won't know where to go to get the passwords. An unskilled attacker with instructions can type in a url to get a password dumper, and be in and out in 30 seconds plus memorization/transcription time.
- Ovid 13y ago
  A little brother using Chrome regularly won't know about keyloggers, how to write a clever bookmarklet, or even be allowed to be around when his big sister is typing in her password. But there's a good chance he does know about clicking that little icon, choosing "settings", and seeing all of his big sister's passwords when she's out on a date and forgot to lock her computer. Locks on your front door knob are not there to keep out burglars. They're there to prevent opportunistic crime: someone who tries that doorknob out of curiosity and discovers a home full of stuff and no one around. There's a large middle ground between good guys, bad guys, and those who might, just might, be tempted to be bad when they find that suitcase full of money. That's what Google is missing here. And in a condescending response[1], someone who is allegedly the Google head of Chrome security called the original author a "novice", claimed Google has "quite a bit of data" to back up their case (without describing the data, its source, or how it was evaluated), and suggested that a master password would make security worse by providing a false sense of security. First, I would suggest that if Google really does have the data mentioned in the claim, release it. Second, a master password isn't going to make the computer safer from a determined black hat because physical access to the machine means game over, but THE MASTER PASSWORD IS NOT ABOUT PROTECTION FROM BLACK HATS. When the colleague who hates you is standing by your unlocked computer when you're off to get coffee and suddenly realizes that he not only can read your email now, but at any time he wants to in the future, that's a problem — when your partner gets suspicious about your working long and you've forgotten to log out — when your little brother realizes he can post "funny" pictures to your Facebook page ... when, when, when ... there are so many areas where this could cause a lot of pain. For example, this is from a blog entry I wrote a decade ago about a young lady who was compromised because LiveJournal stored her username in the cookie and the conservative, religious parents found her blog[2]: I know of a young lady who kept an online journal. Her parents found it and started reading it and were horrified to find out that she was suffering from -- brace yourself -- teen angst! Her parents don't understand her, not enough boys like her, she's not very popular, etc., etc. In reading through the journal, there are no references to doing drugs, sex, or anything else that one might expect a parent to worry about, but this young lady's parents hit the roof. They forbid her to keep an online journal and they grounded her (naturally, I'm sure this cured the angst problem). The parents had physical access to the computer and were smart enough to look at cookie data (these parents weren't technically sophisticated, I might add). Can you imagine what would have happened if the parents could then have read all of their daughter's passwords? Google telling users "this isn't really secure, so we're not going to do a damn thing to help you" doesn't help. Google is optimizing against black hats but pretending that opportunistic crime doesn't exist. In physical security, opportunistic criminals tend not to be the brightest or think too deeply about what they're doing, but when the opportunity is there, they go for. Google is happy to give them that opportunity. 1. https://news.ycombinator.com/item?id=6166953 https://news.ycombinator.com/item?id=6166953 2. http://use.perl.org/use.perl.org/_Ovid/journal/13471.html http://use.perl.org/use.perl.org/_Ovid/journal/13471.html

jellicle 13y ago

And this is why I don't use Chrome, nor recommend it to anyone. The dimwit Chrome developers continue their dumb insistence that penetrable security shouldn't exist. "Bathroom doors shouldn't have locks; someone could just kick the door in and then where would you be!" "Houses shouldn't have locks; you've got glass windows, don't you?! It's a false sense of security!" "Prisons shouldn't have 20-foot walls; Home Depot has 21 foot ladders, don't they?! Lex Luthor escaped via helicopter! It's a false sense of security!" "Bicycles shouldn't have locks; there are bolt cutters with five-foot handles, aren't there?! It's a false sense of security!" Of course in the real world, where Chrome developers do not live, we use locks in all these cases. There's a combination of social signalling (this is mine; do not disturb it) as well as legal signalling (locked means an affirmative action must be taken to break the security, which is punishable; unlocked is not punishable) as well as a substantial amount of actual security (the reality is not everyone carries five-foot bolt cutters, even if some people do). Maybe I can put it another way: Android, up through 4.2, only contemplated a single user per tablet. So if you gave your kids (or anyone) the tablet to play with, they had FULL and unrestricted access to your Gmail account, Google Play account, and so on. Someone, eventually, slapped some sense into the Android developers and now Android 4.3 has restricted profiles where you can let the kids play games without giving them access to your Google accounts. That someone needs to get their slapping gloves and wander over to the Chrome development team...

skymt 13y ago
I think it comes down to how the Chrome team is used to thinking about security. Most of Chrome's security work, such as the phishing blacklist and the process sandbox, aims to prevent attacks from malicious web pages. In those circumstances, "pretty good" security gets you nowhere. If there's a difficult but known way to break the sandbox and execute arbitrary code, it needs to be patched. Otherwise, the hole's obscurity won't prevent people from distributing exploit kits. A subtly broken sandbox is almost exactly as secure as no sandbox at all. If you're accustomed to thinking of security in this all-or-nothing way, the Chrome team's argument makes sense. And the state of the Internet encourages this kind of thinking. In the real world there are plenty of gray areas to security, but online there's always a sufficiently advanced and determined attacker.
13y ago

comex 13y ago

I suppose the issue here is that many of the people who might "compromise" one's browsing session don't fit the model of an evil attacker. They might be friendly pranksters, or unfriendly but not invested enough in the "attack" to go to much effort to perform it. Part of the reason it makes a difference, as noted, is most people's lack of technical knowledge, which might not be a good thing to rely on (though it will probably continue to exist for the foreseeable future), but even with the knowledge that alternatives exist, it feels more evil to go after them. In computer security, it's common to look down on security measures that are bypassable, even if they have some deterrent effect, because hackers wise up fast, and the false sense of security the measures tend to provide is actively harmful. But there's a difference between hackers and the general population... The other comment in this thread about locking doors is a good analogy. The chance that locking my door (in a house with many ground-floor windows and no home security system) will deter an actual burglar is nil. But it could certainly deter some strange neighbor from sneaking in and perhaps stealing things. on the other hand - justinschuh mentioned that they've "literally spent years evaluating it and have quite a bit of data to inform our position". Opinions formed off the top of our heads don't mean that much.

rbobby 13y ago

It seems that an undifferentiated threat model is being used. Within the scope of physical access to an unlocked device all attackers are considered to be ultimately sophisticated and absolutely untrustworthy. This model is clearly lacking, and is not appropriate for software as widely deployed as Chrome.

kefs 13y ago

Relevant reading: http://raidersec.blogspot.in/2013/06/how-browsers-store-your-passwords-and.html http://raidersec.blogspot.in/2013/06/how-browsers-store-your... Also, if you're on FF, do yourself a favour and turn on a master password before it's too late (Tools > Settings > Security).

laureny 13y ago

Why is it so hard for the Chrome team to realize how harmful it is to see passwords in clear text without any effort on the part of the intruder. Baffling to me really, especially coming from Google. They are going to turn around on this, I am certain of it, but why it's taking them so long is beyond me.

CoryG89 13y ago

I've often thought that it was strange that these passwords were stored in plain text. Although. At least with the version of Firefox my old workplace had on their machines, I was able to view all the passwords stored in it as well. Not sure if this has been fixed, but at least it's not always been just Chrome guilty of this.

johnpowell 13y ago
Just checked with latest FF on OS 10.8.4. Click a button and you can see all of them. Safari will prompt for a password.
- neilparikh 13y ago
  Firefox allows you set a master password, which will hide stored passwords and not allow you to access them until you enter the master password. I think this also encrypts the stored passwords, but I'm not sure about that.

cheald 13y ago

Something I've found rather silly in this whole kerfluffle is a failure to recognize that a physical-access attacker can just as easily copy your Chrome/Firefox/whatever profile to a thumb drive, and he now has a full copy of all of your login cookies, many of which are going to permit bypass of 2FA. I like the idea of there being a challenge in Chrome before my passwords are displayed, but its actual impact on actual security is pretty negligible.

bookface 13y ago
I disagree. Maybe if anybody who would ever have physical access to your computer has the technical chops of the average HN commenter, it wouldn't do much for you. However, for somebody leaving their computer alone for a few minutes in a coffee shop or college library, this could definitely deter many opportunists.
- cheald 13y ago
  I...just said that I favor Chrome having a challenge before displaying passwords. I also said that I agree with the Chrome team's position that it doesn't substantially improve security against a physical attacker. I'd like Chrome to have it, but I also know that having your passwords behind a master password doesn't actually result in your web-based accounts being secured against a physical attacker. A challenge dialog is going to deter the "casual" snoop. I'm all for it as a defense-in-depth measure. My point is that you can encrypt your passwords all you want, but even in that case, physical access is game over because there are additional attack vectors that don't require a passphrase to breach. And honestly, if I left my computer alone in a coffee shop or library, I'd be much more worried that someone would pick it up and walk off with it than that someone is going to look at my Chrome passwords. Good luck memorizing those 16-character randomly-generated phrases that I can't reliably remember after two months of repeated use.
  - interpol_p 13y ago
    > A challenge dialog is going to deter the "casual" snoop. I think the "casual" snoop is far more likely than the determined attacker with physical access. Which is why the Chrome team's position on this is baffling. There are so many cases where I hand my computer over to coworkers, friends, family. I trust them all not to explicitly circumvent the security of my machine, but I definitely don't trust some of them not to "casually snoop."

abalone 13y ago

Are these supposed security experts completely ignorant about how Mac OSX Keychain works? This is the basis of much of the argument in favor of Chrome's approach: >In all cases, if you have access to the machine, all it takes is trivial software that's widely available to snoop on anyone else using the machine. This has been repeated elsewhere including by the Chrome security engineer in so many words. Paraphrasing, "if you've got physical access to the machine, everything else is just theater, so we just go ahead and make that obvious." But.... OSX requires the admin password before installing any software. That would seem to invalidate the above argument. Or is there actually a way to bypass OSX Keychain.. and if so how "trivial" is it? Certainly nothing comes up in a quick google search. You'd think it'd be big news, that Apple's whole security framework is just "theater".

ZeroGravitas 13y ago
I'm fairly sure that I've installed (and run) Mac OS X apps via drag and drop with no admin prompt.
- abalone 13y ago
  Hmm, maybe it's just the System and root Library folders that require authentication. But those would be what you'd need to access to install a keylogger or some such monitoring software, I'd guess.
makomk 13y ago
Chrome already uses the OSX Keychain to store passwords. Firefox, on the other hand, stores them as plaintext unless you find and use the option to set a master password.
- abalone 13y ago
  That's kind of beside the point. While Chrome may store passwords encrypted via Keychain, the problem is it readily displays them to the user via its UI without any re-authentication. Its creators think that any attempts to authenticate users beyond the system login are "theater". Is this really true for OS X Keychain? Are its admin password prompts for actions like installing system components or displaying secrets in the UI just theater?

eli 13y ago

Sounds like the debate over running SSH on a nonstandard port. Sure, it provides only a little protection and only against opportunistic, drive-by attacks... but it's easy to do and it can't hurt. So why not?

deleted 13y ago

[deleted]

ColinWright 13y ago

This hit the news three weeks ago. Here's a submission with 305 comments, including a reply from the Chrome browser security tech lead: https://news.ycombinator.com/item?id=6165708 https://news.ycombinator.com/item?id=6165708 Here are some other submission: https://news.ycombinator.com/item?id=6167331 https://news.ycombinator.com/item?id=6167331 https://news.ycombinator.com/item?id=6171813 https://news.ycombinator.com/item?id=6171813 (many comments) https://news.ycombinator.com/item?id=6171979 https://news.ycombinator.com/item?id=6171979 https://news.ycombinator.com/item?id=6173106 https://news.ycombinator.com/item?id=6173106 (many comments) https://news.ycombinator.com/item?id=6173582 https://news.ycombinator.com/item?id=6173582 https://news.ycombinator.com/item?id=6175012 https://news.ycombinator.com/item?id=6175012 https://news.ycombinator.com/item?id=6177417 https://news.ycombinator.com/item?id=6177417 https://news.ycombinator.com/item?id=6180711 https://news.ycombinator.com/item?id=6180711

7952 13y ago

If the password submission was handled in javascript couldn't the website rewrite the password field with a one time password. This would let people use password storage, but give the ability to revoke later on. The only difference between a stored password and a cookie, is that cookies are trusted less. Both can give password equivalent access.

CamperBob2 13y ago

I don't get the controversy. There are very few reasons to have multiple user accounts on a home PC, but this sounds like one of them. If you want to lend your PC to someone or allow other friends/family members to access it at will, you need to create separate user accounts for those people. Problem solved.

bonaldi 13y ago

Not sure why "you can just use the DOM inspector" is so often accepted without question. Why does the DOM inspector happily show you a password? Shouldn't the browser be keeping track of those it has autofilled and prompting for a password before exposing them there, too?