5 ms·

The purpose of a master password is not to provide perfect security or a false sense thereof. The purpose is to impede an unskilled attacker who has only moment

The purpose of a master password is not to provide perfect security or a false sense thereof. The purpose is to impede an unskilled attacker who has only momentary access (like the amount of time it takes to type chrome://settings/passwords on a temporarily unattended machine) and mitigate the severity of what can be done by an unskilled attacker in the event of such a short breach. It might be proper security engineering practice, but it strikes me as being totally out-of-touch with regular humans and mere mortal users to insist that once any attacker has access for any duration, you're completely hosed anyway, so why not make it easy for them.

dgesang 13y ago
This! The assumption that some uber-1337-hax0r is accessing the system who will install a rootkit just by looking at it is just not close to reality. It is on the other hand a very real situation that some weird friends, family members or co-workers have access to your system while you're not looking.
Dylan16807 13y ago
An unskilled attacker with no knowledge won't know where to go to get the passwords. An unskilled attacker with instructions can type in a url to get a password dumper, and be in and out in 30 seconds plus memorization/transcription time.
- Ovid 13y ago
  A little brother using Chrome regularly won't know about keyloggers, how to write a clever bookmarklet, or even be allowed to be around when his big sister is typing in her password. But there's a good chance he does know about clicking that little icon, choosing "settings", and seeing all of his big sister's passwords when she's out on a date and forgot to lock her computer. Locks on your front door knob are not there to keep out burglars. They're there to prevent opportunistic crime: someone who tries that doorknob out of curiosity and discovers a home full of stuff and no one around. There's a large middle ground between good guys, bad guys, and those who might, just might, be tempted to be bad when they find that suitcase full of money. That's what Google is missing here. And in a condescending response[1], someone who is allegedly the Google head of Chrome security called the original author a "novice", claimed Google has "quite a bit of data" to back up their case (without describing the data, its source, or how it was evaluated), and suggested that a master password would make security worse by providing a false sense of security. First, I would suggest that if Google really does have the data mentioned in the claim, release it. Second, a master password isn't going to make the computer safer from a determined black hat because physical access to the machine means game over, but THE MASTER PASSWORD IS NOT ABOUT PROTECTION FROM BLACK HATS. When the colleague who hates you is standing by your unlocked computer when you're off to get coffee and suddenly realizes that he not only can read your email now, but at any time he wants to in the future, that's a problem — when your partner gets suspicious about your working long and you've forgotten to log out — when your little brother realizes he can post "funny" pictures to your Facebook page ... when, when, when ... there are so many areas where this could cause a lot of pain. For example, this is from a blog entry I wrote a decade ago about a young lady who was compromised because LiveJournal stored her username in the cookie and the conservative, religious parents found her blog[2]: I know of a young lady who kept an online journal. Her parents found it and started reading it and were horrified to find out that she was suffering from -- brace yourself -- teen angst! Her parents don't understand her, not enough boys like her, she's not very popular, etc., etc. In reading through the journal, there are no references to doing drugs, sex, or anything else that one might expect a parent to worry about, but this young lady's parents hit the roof. They forbid her to keep an online journal and they grounded her (naturally, I'm sure this cured the angst problem). The parents had physical access to the computer and were smart enough to look at cookie data (these parents weren't technically sophisticated, I might add). Can you imagine what would have happened if the parents could then have read all of their daughter's passwords? Google telling users "this isn't really secure, so we're not going to do a damn thing to help you" doesn't help. Google is optimizing against black hats but pretending that opportunistic crime doesn't exist. In physical security, opportunistic criminals tend not to be the brightest or think too deeply about what they're doing, but when the opportunity is there, they go for. Google is happy to give them that opportunity. 1. https://news.ycombinator.com/item?id=6166953 https://news.ycombinator.com/item?id=6166953 2. http://use.perl.org/use.perl.org/_Ovid/journal/13471.html http://use.perl.org/use.perl.org/_Ovid/journal/13471.html
  - thezilch 13y ago
    You're confusing a browser password-keeper with a house lock, when the house is actually synonymous to the machine. Lock the machine. Should every OS come with only encrypted filesystems that you have to enter a password on every read? You know, so your brother doesn't find your sexts logs?
    - Ovid 13y ago
      More and more of our data is being stored online. Many things that you might want to keep confidential is nonetheless behind a poorly designed "firewall" of passwords. That's the problem. Demanding that someone never forget a manual process (locking the machine) is adding a massive point of failure. This is bad.
      - thezilch 13y ago
        What does that have to do with a browser and poor analogies? Neither protect important documents on disk, a shell open with root, an ssh open to your production, etc. I'm not condoning Chrome's actions, but I'd also demand not storing passwords in a browser at all, and do all sensitive browsing in incognito, so your sessions can't be lifted.
  - baddox 13y ago
    But you can always conceive of some would-be attacker with a given skill level. You conceived of a child who knows about Chrome settings but not about keyloggers, and thus concluded that there should be a master password in the browser. But I could just as easily conceive of an attacker who knows how to read a computer screen but doesn't know how to use basic window management, and thus conclude that the browser window should always display all saved passwords as long as the user can minimize the browser. Or toward the other end of the continuum, I could conceive of an attacker who knows how to install a keylogger but doesn't know how to lift and spoof fingerprints, and thus conclude that the browser should require a fingerprint scanner to recall saved passwords. These arguments need to establish why the line should be drawn in that specific spot, rather than just mentioning the line and describing the types of attacks it can thwart.
- spinchange 13y ago
  You're leaving out the time to download, run, then delete the software and any traces that the operation was done. Going to the browser's settings and viewing passwords in plain text requires no installation or execution of code and leaves no trace. It is not as difficult or time consuming. It's kind of back the bike lock analogy: just because someone can take a bolt cutter to it doesn't mean it is pointless to use one.
  - Dylan16807 13y ago
    Go to the site: About as much time as going into settings Download: Less than five seconds Run: If it's a custom tool, less than five seconds to have passwords displayed Delete: click the 'remove' button on the downloads list, less then five seconds In terms of bike locks, this is one you can take off with a pen and no previous practice.
    - spinchange 13y ago
      You're still fundamentally arguing that because a safeguard can be circumvented, there should be no safeguard. There's no question cracking a master password can be accomplished, or even "easily" if you want to insist that, but it is taking extra steps including introducing and running new code and a taking degree of effort that is above and beyond viewing something in plain text in settings. It also assumes foreknowledge of all these things. And by the way, you also forgot deleting the dumper site from the browser's history, (and DNS/proxy records if they're being logged) using a system password to install the software if the system has that kind of security, and so on. But I digress, the point is not that a master password will keep a determined or informed interloper out, it is that it will "keep an honest person honest."
      - Dylan16807 13y ago
        >You're still fundamentally arguing that because a safeguard can be circumvented, there should be no safeguard. No. I'm still a bit undecided on whether a safeguard would be worth adding or not. What I'm arguing is that many of the people making points in favor of a safeguard are doing so on weak reasoning, where they overestimate the effectiveness of it against a casual, untrained attacker. No foreknowledge is needed to make a search, and if you find instructions then I very strongly disagree that running a program is harder than navigating settings. > deleting the dumper site from the browser's history, (and DNS/proxy records if they're being logged) using a system password to install the software if the system has that kind of security Oh come on. This is supposed to be a casual situation where you let someone use your computer. What kind of history-monitored remote-logging computer is going to have saved passwords and unauthorized access in the first place? > keep an honest person honest You already have to enter a page solely for editing passwords and hit specific show buttons per password. There is zero plausible deniability at this point. I think an 'honest' person will already be kept out, and any changes would only matter in marginal situations.
sitharus 13y ago
Can't upvote this enough. It's very hard to stop a determined attacker, but that's not what this is covering. As a developer sometime I peer program, and that might mean handing over the controls to a colleague. Now I trust my colleagues, but you never know what their personal lives might me. If I had, say, saved my internet banking password (I don't, but let's entertain the possibility) they could easily access the password list and copy it, then close it without me ever knowing. It's much like leaving an open safe under my desk. Even if it's a simple lock people won't open it to see what's there. If you know I have a stack of gold you might decide to break in, but you'll know it's wrong.
baddox 13y ago
Yours is a fair enough argument, but I find the line you're drawing to be arbitrary. We can conceive of a continuum of security mechanisms, each with a given strength which can thwart attackers with a given skill level. For example, near one end of the continuum, minimizing the browser when I leave should thwart a computer-illiterate attacker. Somewhere between that end and your suggestion of a master password is Chrome's behavior, where the attacker must know that they can find your passwords in the browser settings. Near the other end might be biometric authentication, or even no option to save passwords at all. A more sufficient version of your argument would attempt to show why the master password is an appropriate place to draw the line on this continuum, perhaps by arguing that it's an optimal balance between minimizing the valid user's frustration and thwarting some percentage of attackers.
- ronaldx 13y ago
  Yes, there is a continuum of security, agreed. The correct place to draw the line is a place where the user has every convenience they want, and an attacker does not have any additional convenience. Revealing plaintext passwords does not convenience the user but it would convenience attackers (with low skill).
  - jtheory 13y ago
    > Revealing plaintext passwords does not convenience the user That bit is not true, with a caveat. I have a ton of low-security username/password pairs stored in FF. I find I do need to look at the plaintext passwords now & again, because I want to open one of those sites on my phone, for example, and don't remember the password (I looked up my HN password just yesterday so I could sign in on my phone, actually). Sometimes I find I've saved multiple pairs for one site, and I need to review the passwords to figure out which is valid. I've used the same feature in Thunderbird with IMAP and SMTP server passwords, when I have an email account I've been using for year w/o changing the password, and I realize I haven't saved it anywhere else. All of these are not hampered by requiring a master password, of course... I'm in agreement with timbl on his reasons not to allow just anyone to view these by default.
  - baddox 13y ago

dgesang 13y ago

This! The assumption that some uber-1337-hax0r is accessing the system who will install a rootkit just by looking at it is just not close to reality. It is on the other hand a very real situation that some weird friends, family members or co-workers have access to your system while you're not looking.

Dylan16807 13y ago

An unskilled attacker with no knowledge won't know where to go to get the passwords. An unskilled attacker with instructions can type in a url to get a password dumper, and be in and out in 30 seconds plus memorization/transcription time.

Ovid 13y ago
A little brother using Chrome regularly won't know about keyloggers, how to write a clever bookmarklet, or even be allowed to be around when his big sister is typing in her password. But there's a good chance he does know about clicking that little icon, choosing "settings", and seeing all of his big sister's passwords when she's out on a date and forgot to lock her computer. Locks on your front door knob are not there to keep out burglars. They're there to prevent opportunistic crime: someone who tries that doorknob out of curiosity and discovers a home full of stuff and no one around. There's a large middle ground between good guys, bad guys, and those who might, just might, be tempted to be bad when they find that suitcase full of money. That's what Google is missing here. And in a condescending response[1], someone who is allegedly the Google head of Chrome security called the original author a "novice", claimed Google has "quite a bit of data" to back up their case (without describing the data, its source, or how it was evaluated), and suggested that a master password would make security worse by providing a false sense of security. First, I would suggest that if Google really does have the data mentioned in the claim, release it. Second, a master password isn't going to make the computer safer from a determined black hat because physical access to the machine means game over, but THE MASTER PASSWORD IS NOT ABOUT PROTECTION FROM BLACK HATS. When the colleague who hates you is standing by your unlocked computer when you're off to get coffee and suddenly realizes that he not only can read your email now, but at any time he wants to in the future, that's a problem — when your partner gets suspicious about your working long and you've forgotten to log out — when your little brother realizes he can post "funny" pictures to your Facebook page ... when, when, when ... there are so many areas where this could cause a lot of pain. For example, this is from a blog entry I wrote a decade ago about a young lady who was compromised because LiveJournal stored her username in the cookie and the conservative, religious parents found her blog[2]: I know of a young lady who kept an online journal. Her parents found it and started reading it and were horrified to find out that she was suffering from -- brace yourself -- teen angst! Her parents don't understand her, not enough boys like her, she's not very popular, etc., etc. In reading through the journal, there are no references to doing drugs, sex, or anything else that one might expect a parent to worry about, but this young lady's parents hit the roof. They forbid her to keep an online journal and they grounded her (naturally, I'm sure this cured the angst problem). The parents had physical access to the computer and were smart enough to look at cookie data (these parents weren't technically sophisticated, I might add). Can you imagine what would have happened if the parents could then have read all of their daughter's passwords? Google telling users "this isn't really secure, so we're not going to do a damn thing to help you" doesn't help. Google is optimizing against black hats but pretending that opportunistic crime doesn't exist. In physical security, opportunistic criminals tend not to be the brightest or think too deeply about what they're doing, but when the opportunity is there, they go for. Google is happy to give them that opportunity. 1. https://news.ycombinator.com/item?id=6166953 https://news.ycombinator.com/item?id=6166953 2. http://use.perl.org/use.perl.org/_Ovid/journal/13471.html http://use.perl.org/use.perl.org/_Ovid/journal/13471.html
- thezilch 13y ago
  You're confusing a browser password-keeper with a house lock, when the house is actually synonymous to the machine. Lock the machine. Should every OS come with only encrypted filesystems that you have to enter a password on every read? You know, so your brother doesn't find your sexts logs?
  - Ovid 13y ago
    More and more of our data is being stored online. Many things that you might want to keep confidential is nonetheless behind a poorly designed "firewall" of passwords. That's the problem. Demanding that someone never forget a manual process (locking the machine) is adding a massive point of failure. This is bad.
    - thezilch 13y ago
      What does that have to do with a browser and poor analogies? Neither protect important documents on disk, a shell open with root, an ssh open to your production, etc. I'm not condoning Chrome's actions, but I'd also demand not storing passwords in a browser at all, and do all sensitive browsing in incognito, so your sessions can't be lifted.
- baddox 13y ago
  But you can always conceive of some would-be attacker with a given skill level. You conceived of a child who knows about Chrome settings but not about keyloggers, and thus concluded that there should be a master password in the browser. But I could just as easily conceive of an attacker who knows how to read a computer screen but doesn't know how to use basic window management, and thus conclude that the browser window should always display all saved passwords as long as the user can minimize the browser. Or toward the other end of the continuum, I could conceive of an attacker who knows how to install a keylogger but doesn't know how to lift and spoof fingerprints, and thus conclude that the browser should require a fingerprint scanner to recall saved passwords. These arguments need to establish why the line should be drawn in that specific spot, rather than just mentioning the line and describing the types of attacks it can thwart.
spinchange 13y ago
You're leaving out the time to download, run, then delete the software and any traces that the operation was done. Going to the browser's settings and viewing passwords in plain text requires no installation or execution of code and leaves no trace. It is not as difficult or time consuming. It's kind of back the bike lock analogy: just because someone can take a bolt cutter to it doesn't mean it is pointless to use one.
- Dylan16807 13y ago
  Go to the site: About as much time as going into settings Download: Less than five seconds Run: If it's a custom tool, less than five seconds to have passwords displayed Delete: click the 'remove' button on the downloads list, less then five seconds In terms of bike locks, this is one you can take off with a pen and no previous practice.
  - spinchange 13y ago
    You're still fundamentally arguing that because a safeguard can be circumvented, there should be no safeguard. There's no question cracking a master password can be accomplished, or even "easily" if you want to insist that, but it is taking extra steps including introducing and running new code and a taking degree of effort that is above and beyond viewing something in plain text in settings. It also assumes foreknowledge of all these things. And by the way, you also forgot deleting the dumper site from the browser's history, (and DNS/proxy records if they're being logged) using a system password to install the software if the system has that kind of security, and so on. But I digress, the point is not that a master password will keep a determined or informed interloper out, it is that it will "keep an honest person honest."
    - Dylan16807 13y ago
      >You're still fundamentally arguing that because a safeguard can be circumvented, there should be no safeguard. No. I'm still a bit undecided on whether a safeguard would be worth adding or not. What I'm arguing is that many of the people making points in favor of a safeguard are doing so on weak reasoning, where they overestimate the effectiveness of it against a casual, untrained attacker. No foreknowledge is needed to make a search, and if you find instructions then I very strongly disagree that running a program is harder than navigating settings. > deleting the dumper site from the browser's history, (and DNS/proxy records if they're being logged) using a system password to install the software if the system has that kind of security Oh come on. This is supposed to be a casual situation where you let someone use your computer. What kind of history-monitored remote-logging computer is going to have saved passwords and unauthorized access in the first place? > keep an honest person honest You already have to enter a page solely for editing passwords and hit specific show buttons per password. There is zero plausible deniability at this point. I think an 'honest' person will already be kept out, and any changes would only matter in marginal situations.

sitharus 13y ago

Can't upvote this enough. It's very hard to stop a determined attacker, but that's not what this is covering. As a developer sometime I peer program, and that might mean handing over the controls to a colleague. Now I trust my colleagues, but you never know what their personal lives might me. If I had, say, saved my internet banking password (I don't, but let's entertain the possibility) they could easily access the password list and copy it, then close it without me ever knowing. It's much like leaving an open safe under my desk. Even if it's a simple lock people won't open it to see what's there. If you know I have a stack of gold you might decide to break in, but you'll know it's wrong.

baddox 13y ago

Yours is a fair enough argument, but I find the line you're drawing to be arbitrary. We can conceive of a continuum of security mechanisms, each with a given strength which can thwart attackers with a given skill level. For example, near one end of the continuum, minimizing the browser when I leave should thwart a computer-illiterate attacker. Somewhere between that end and your suggestion of a master password is Chrome's behavior, where the attacker must know that they can find your passwords in the browser settings. Near the other end might be biometric authentication, or even no option to save passwords at all. A more sufficient version of your argument would attempt to show why the master password is an appropriate place to draw the line on this continuum, perhaps by arguing that it's an optimal balance between minimizing the valid user's frustration and thwarting some percentage of attackers.

ronaldx 13y ago
Yes, there is a continuum of security, agreed. The correct place to draw the line is a place where the user has every convenience they want, and an attacker does not have any additional convenience. Revealing plaintext passwords does not convenience the user but it would convenience attackers (with low skill).
- jtheory 13y ago
  > Revealing plaintext passwords does not convenience the user That bit is not true, with a caveat. I have a ton of low-security username/password pairs stored in FF. I find I do need to look at the plaintext passwords now & again, because I want to open one of those sites on my phone, for example, and don't remember the password (I looked up my HN password just yesterday so I could sign in on my phone, actually). Sometimes I find I've saved multiple pairs for one site, and I need to review the passwords to figure out which is valid. I've used the same feature in Thunderbird with IMAP and SMTP server passwords, when I have an email account I've been using for year w/o changing the password, and I realize I haven't saved it anywhere else. All of these are not hampered by requiring a master password, of course... I'm in agreement with timbl on his reasons not to allow just anyone to view these by default.
- baddox 13y ago