5 ms·

Something I've found rather silly in this whole kerfluffle is a failure to recognize that a physical-access attacker can just as easily copy your Chrome/Firefox

by cheald 13y ago

Something I've found rather silly in this whole kerfluffle is a failure to recognize that a physical-access attacker can just as easily copy your Chrome/Firefox/whatever profile to a thumb drive, and he now has a full copy of all of your login cookies, many of which are going to permit bypass of 2FA. I like the idea of there being a challenge in Chrome before my passwords are displayed, but its actual impact on actual security is pretty negligible.

bookface 13y ago
I disagree. Maybe if anybody who would ever have physical access to your computer has the technical chops of the average HN commenter, it wouldn't do much for you. However, for somebody leaving their computer alone for a few minutes in a coffee shop or college library, this could definitely deter many opportunists.
- cheald 13y ago
  I...just said that I favor Chrome having a challenge before displaying passwords. I also said that I agree with the Chrome team's position that it doesn't substantially improve security against a physical attacker. I'd like Chrome to have it, but I also know that having your passwords behind a master password doesn't actually result in your web-based accounts being secured against a physical attacker. A challenge dialog is going to deter the "casual" snoop. I'm all for it as a defense-in-depth measure. My point is that you can encrypt your passwords all you want, but even in that case, physical access is game over because there are additional attack vectors that don't require a passphrase to breach. And honestly, if I left my computer alone in a coffee shop or library, I'd be much more worried that someone would pick it up and walk off with it than that someone is going to look at my Chrome passwords. Good luck memorizing those 16-character randomly-generated phrases that I can't reliably remember after two months of repeated use.
  - interpol_p 13y ago
    > A challenge dialog is going to deter the "casual" snoop. I think the "casual" snoop is far more likely than the determined attacker with physical access. Which is why the Chrome team's position on this is baffling. There are so many cases where I hand my computer over to coworkers, friends, family. I trust them all not to explicitly circumvent the security of my machine, but I definitely don't trust some of them not to "casually snoop."
  - bookface 13y ago
    I know you said that, but I disagree that it has a negligible contribution to security based on the distribution of skill level of potential attackers. You are definitely right about my leaving the computer alone example. That was pretty absurd.

by cheald 13y ago

bookface 13y ago

I disagree. Maybe if anybody who would ever have physical access to your computer has the technical chops of the average HN commenter, it wouldn't do much for you. However, for somebody leaving their computer alone for a few minutes in a coffee shop or college library, this could definitely deter many opportunists.

cheald 13y ago
I...just said that I favor Chrome having a challenge before displaying passwords. I also said that I agree with the Chrome team's position that it doesn't substantially improve security against a physical attacker. I'd like Chrome to have it, but I also know that having your passwords behind a master password doesn't actually result in your web-based accounts being secured against a physical attacker. A challenge dialog is going to deter the "casual" snoop. I'm all for it as a defense-in-depth measure. My point is that you can encrypt your passwords all you want, but even in that case, physical access is game over because there are additional attack vectors that don't require a passphrase to breach. And honestly, if I left my computer alone in a coffee shop or library, I'd be much more worried that someone would pick it up and walk off with it than that someone is going to look at my Chrome passwords. Good luck memorizing those 16-character randomly-generated phrases that I can't reliably remember after two months of repeated use.
- interpol_p 13y ago
  > A challenge dialog is going to deter the "casual" snoop. I think the "casual" snoop is far more likely than the determined attacker with physical access. Which is why the Chrome team's position on this is baffling. There are so many cases where I hand my computer over to coworkers, friends, family. I trust them all not to explicitly circumvent the security of my machine, but I definitely don't trust some of them not to "casually snoop."
- bookface 13y ago
  I know you said that, but I disagree that it has a negligible contribution to security based on the distribution of skill level of potential attackers. You are definitely right about my leaving the computer alone example. That was pretty absurd.