3 ms·

You drew an analogy with having root and being able to edit the sudoers file, but note that in that case the attacker is not able to see any passwords, only cha

You drew an analogy with having root and being able to edit the sudoers file, but note that in that case the attacker is not able to see any passwords, only change them. I think it provides a useful level of security if the browser would encrypt stored passwords with a master key, using an OS-provided keychain. As with Safari, it could then ask for the master password before showing any passwords, while remembering the same password for normal logins for convenience. This is under the assumption that revealing your password is worse than somebody being able to use your accounts.

MichaelGG 13y ago
Please explain the exact algorithm that the browser stores encrypted passwords and needs a master password before showing, but can "remember for convenience". Or do you mean that it'll prompt people for a master password for uncommonly used sites? Because that's just going to lead to people forgetting the master password and having to do a password reset.
- andreasvc 13y ago
  My suggestion would be to use the OS keychain facilities, so the master password would be the same as the one used to log in. The master password is only needed once to decrypt the passwords, but I'm suggesting that for the 'show passwords' functionality the browser should insist on asking the password again. The advantage is that on disk, passwords are not stored in plaintext, and the browser doesn't reveal passwords trivially. A determined attacker could still extract the encryption key from a memory dump, but that's on a completely different level from a "show passwords" button.
  - makomk 13y ago
    Chrome already uses the OS keychain facilities. People are complaining that this is insecure because unauthorized people can look at the saved passwords if the user leaves their computer logged in and unlocked. They want Chrome to adopt the Firefox approach of storing them directly on disk optionally encrypted with a master password.
    - andreasvc 13y ago
      Or the Safari approach, where even though it could show you the passwords directly, its policy is to ask for your password before doing so. Note that while Chrome uses the keychain, it actually circumvents the point of the keychain by decrypting all keys at startup, before they're needed.

MichaelGG 13y ago

Please explain the exact algorithm that the browser stores encrypted passwords and needs a master password before showing, but can "remember for convenience". Or do you mean that it'll prompt people for a master password for uncommonly used sites? Because that's just going to lead to people forgetting the master password and having to do a password reset.

andreasvc 13y ago
My suggestion would be to use the OS keychain facilities, so the master password would be the same as the one used to log in. The master password is only needed once to decrypt the passwords, but I'm suggesting that for the 'show passwords' functionality the browser should insist on asking the password again. The advantage is that on disk, passwords are not stored in plaintext, and the browser doesn't reveal passwords trivially. A determined attacker could still extract the encryption key from a memory dump, but that's on a completely different level from a "show passwords" button.
- makomk 13y ago
  Chrome already uses the OS keychain facilities. People are complaining that this is insecure because unauthorized people can look at the saved passwords if the user leaves their computer logged in and unlocked. They want Chrome to adopt the Firefox approach of storing them directly on disk optionally encrypted with a master password.
  - andreasvc 13y ago
    Or the Safari approach, where even though it could show you the passwords directly, its policy is to ask for your password before doing so. Note that while Chrome uses the keychain, it actually circumvents the point of the keychain by decrypting all keys at startup, before they're needed.