4 ms·

Stores passwords in plain text on disk: http://code.google.com/p/chromium/issues/detail?id=25404&q=password&colspec=ID%20Stars%20Pri%20Area%20Type%20Status%20Su

by alec 17y ago

Stores passwords in plain text on disk: http://code.google.com/p/chromium/issues/detail?id=25404&q=password&colspec=ID%20Stars%20Pri%20Area%20Type%20Status%20Summary%20Modified%20Owner%20Mstone%20OS http://code.google.com/p/chromium/issues/detail?id=25404&#38... I noticed that detail when I was trying out Chromium a while back, and it still hasn't been fixed. It seems like a simple but basic security feature. I don't know what else isn't done yet, but it does make me worry. No guarantees that Firefox isn't doing similar things I'd object to, but I don't know about them, so for better or worse I have more confidence in it.

smanek 17y ago
What's the alternative? Even if it encrypts the password before storing them on disk, the encryption/decryption key are necessarily on disk anyways, no?
- sid0 17y ago
  You can make the user enter a master password.
- geocar 17y ago
  No. You can use a master password to decrypt your encrypted password database. Your operating system might have a keyring service or an encrypted filesystem you can use to store your keys in. You might even use a hardware token, or some specialized on-board hardware for storing your passwords securely.
  - est 17y ago
    It's just a matter of time to find the right auto-fill form and replay the HTTP post data.
- tsuraan 17y ago
  Every desktop environment that I'm familiar with (OSX, KDE, Gnome) has a built-in password manager to hook into, that stores the data encrypted and prompts the user for a master password in some configurable way. I'm guessing that if the OSX and Linux variations of Chrome get any traction, hooking into the password manager will probably be done. I have no idea if Windows has a password manager, but I don't know why it wouldn't.
  - jsz0 17y ago
    The OSX version seems to use KeyChain.
zacharydanger 17y ago
Firefox does the exact same thing unless you setup a "master" password that you have to enter when you launch it.
pyre 17y ago
How about just not using the browser to store you passwords?
- deleted 17y ago
  [deleted]

by alec 17y ago

smanek 17y ago

What's the alternative? Even if it encrypts the password before storing them on disk, the encryption/decryption key are necessarily on disk anyways, no?

sid0 17y ago
You can make the user enter a master password.
geocar 17y ago
No. You can use a master password to decrypt your encrypted password database. Your operating system might have a keyring service or an encrypted filesystem you can use to store your keys in. You might even use a hardware token, or some specialized on-board hardware for storing your passwords securely.
- est 17y ago
  It's just a matter of time to find the right auto-fill form and replay the HTTP post data.
tsuraan 17y ago
Every desktop environment that I'm familiar with (OSX, KDE, Gnome) has a built-in password manager to hook into, that stores the data encrypted and prompts the user for a master password in some configurable way. I'm guessing that if the OSX and Linux variations of Chrome get any traction, hooking into the password manager will probably be done. I have no idea if Windows has a password manager, but I don't know why it wouldn't.
- jsz0 17y ago
  The OSX version seems to use KeyChain.

zacharydanger 17y ago

Firefox does the exact same thing unless you setup a "master" password that you have to enter when you launch it.

pyre 17y ago

How about just not using the browser to store you passwords?

deleted 17y ago
[deleted]