10 ms·

Microsoft Edge stores all passwords in memory in clear text, even when unused

• gregogy 4mo ago
  [flagged]
• eddy-sekorti 4mo ago
  That is why i never use edge, chrome is much better in every aspect, cannot understand how Microsoft can be so stupid to do this
• OhMeadhbh 4mo ago
  In 2003 I interviewed to be security architect for MSFT Office. My final interview was with the guy they told me was "the most senior programmer in the office group" who had "been with the company since Albuquerque." This was in the middle of the 2003 security stand-down and he started by asking "How are your QA skills? Cause in a couple months Bill (Gates) is going to forget all about security and we'll get back to writing code the way we always have. And we won't need a Security Architect so we'll have to find a job for you and I was thinking QA." Corners of Microsoft doing stupid things with respect to security isn't an accident. It's a natural consequence of their culture. That being said... There are (or at least were) some amazingly good security brains in Redmond. It's just that not all groups got the security memo.
• mfro 5mo ago
  To be fair, 'loads into memory' and 'stores' are not the same thing.
  • saghm 5mo ago
    The headline here says "stores in memory", which sounds pretty much identical to me. Can you elaborate on what you consider the difference between "loading" and "storing" into memory?
    • mfro 5mo ago
      When someone says passwords are ‘stored’, the assumption will always be ‘stored on disk’. ‘stores in memory’ is not an accurate representation because memory is inherently volatile and they are loaded there temporarily. Plaintext on disk is egregious, plaintext in memory is considerably less so.
      • jazzyjackson 5mo ago
        especially when the point of a password manager is to stick a plaintext string into a webpage, which then transmits the plain text to a remote server. passwords are just not a very good solution to keeping secrets.
        • StilesCrisis 5mo ago
          Never enter your password into a website that doesn't use https.
          • jonathanlydall 5mo ago
            *over any untrustworthy network. To fair though, there are very few situations where the network is completely trustworthy, like your home network with no one else on it or a VPN direct to an HTTP server.
            • StilesCrisis 5mo ago
              My understanding was that if you have a valid https session, you are good. A really really untrustworthy network could MITM your SSL connections and impose itself in front of all of them (Cisco IronPort?) but I think even then your browser will complain unless you've installed a proxy that allows it or a custom root certificate.
              • jonathanlydall 4mo ago
                If there is no one else on the network between you and the server (like on your wired home LAN with no one else on it), you’re good, regardless of HTTPs. It’s not enough for the network to be untrustworthy for MITM attacks, they have to use a certificate signed a by root certificate that your computer already trusts. Organizations with those IronPort gateways use device management and Active Directory policies to pre-install a root certificate into your OS. The IronPort decrypts the original server then re-encrypts it with its own certificate to your computer. If you used a non-organization managed device on those networks, it would show big scary warnings before letting you visit any HTTPS site that the certificate issuer is not trusted by your computer.
  • johanyc 5mo ago
    Tbf the point of the post is the "even when unused" part. A memory store is still a store.
• mghackerlady 5mo ago
  Why wouldn't it? What else would you expect from the p̶e̶o̶p̶l̶e̶ masochists who subjected us to internet explorer
• gruez 5mo ago
  This feels like a case of "It rather involved being on the other side of this airtight hatchway"[1]. If you can read arbitrary process memory, you're probably also in a position to just dump out the passwords by pretending to be the user in question. > If an attacker gains administrative access on a terminal server, they can access the memory of all logged‑on user processes. If an attacker has administrative access, they can also attach a debugger to every chrome process and force it to decrypt all the passwords. The only difference this really makes is in coldboot attacks, but even then it's still not clear whether it makes the attacker's job slightly easier, or allows an attack that's otherwise not possible. [1] https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31283 https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31...
  • turtlebits 5mo ago
    Security isn't black and white. If i leave a post-it note of my logins on my monitor, that's definitely less safe than in a unlocked drawer, and so on.
    • stouset 5mo ago
      If I leave a post-it note of passwords on my monitor inside a vault to which only I have access, it’s not a big deal. That’s the point of the “airtight hatch” metaphor.
      • Someone1234 5mo ago
        Right; but in the scenario of this Tweek, you've invited someone untrustworthy into the vault and are then freaking out because they can see the post-it note of passwords. It is inherently irrational. This issue is inherently unfixable by ANY password manager, because the process model of the underlying OS isn't itself secure. No obfuscation will work, because the password manager itself needs to de-obfuscation it before use (and that memory too is dump-able). All adding in-memory obfuscation does it make ignorant people feel better, while not moving the security needle even an inch.
        • 5mo ago
• kleiba2 5mo ago
  Does this tool access an Edge instance running on the same machine? Couldn't you then just simply export all saved passwords anyway? https://support.microsoft.com/en-us/topic/export-passwords-in-microsoft-edge-15c0b4f5-e490-4034-b699-1063bad0cc2d https://support.microsoft.com/en-us/topic/export-passwords-i...
  • riedel 5mo ago
    Password managers often go through quite some hassle to keep passwords 'safe' in memory. However, I often do not get the attack model of many of those tools. Tools like keepass e.g. go through quite to register a browser plugin. But then anyone with normal user rights can extract that key from the browser and do everything with it. Also this whole 'trust this browser' stuff of web apps seems strange if one e.g. can read the cookie store easily...
    • munk-a 5mo ago
      Cookies, if done correctly, will store a string that the server offered after a successful authentication - that string should have nothing to do with the password (it might contain some user information for logging/cross site tracking) but nothing sensitive. With said cookie you can absolutely impersonate a user for while (potentially needing to evade user agent string checks and the like but often not)... but it will expire and then your access should be ended. If the site is well designed actions like password changing should also re-require the user's password instead of allowing anyone with just the cookie from proceeding with the action. If it is done right cookies are pretty decently secure at keeping your secrets safe but, for convenience they do lower the security that could be accomplished with more involved techniques. As an aside Oauth's key -> token approach is basically identical to password -> cookie (assuming best practices are in place).
      • ylk 5mo ago
        There are (illegal) marketplaces initial access brokers sell session cookies on. Some companies try to defend against that by e.g. checking whether it's even possible that you travelled from place A to place B within a certain timeframe and, based on that, might invalidate your cookie. But then again attackers, depending on their sophistication, find their ways around it by ensuring they proxy their traffic via geographically close residential proxies, use the same OS and browser versions, etc. Google now wants to bind credentials to a device by storing the secret in the TPM: https://blog.google/security/protecting-cookies-with-device-bound-session-credentials/ https://blog.google/security/protecting-cookies-with-device-...
• myHNAccount123 5mo ago
  https://xcancel.com/L1v1ng0ffTh3L4N/status/2051308329880719730 https://xcancel.com/L1v1ng0ffTh3L4N/status/20513083298807197...
• WolfeReader 5mo ago
  Please use a dedicated password manager, instead of a browser-based one. KeePass is likely the best going forward.
  • 75central 5mo ago
    Out of curiosity, why KeePass versus Bitwarden? I've been using Bitwarden for years, but if there's a specific reason I should be using KeePass instead, I'm open to changing.
    • WolfeReader 5mo ago
      Bitwarden has taken investor money, sadly. It's still in good shape for the moment. But the time will come when they place profits above other needs; it's a matter of when, not if.
      • jazzyjackson 5mo ago
        Luckily offering enterprise / credential sharing features is a decent freemium model. It still wins out in keeping compatibility with self hosted vaultwarden, are there other extensions that let you point to your own domain for the encrypted blob storage?
    • dcanelhas 5mo ago
      KeePass is just an encrypted database file with UI around it for usability. You can keep the db on a USB drive, sync it through a cloud storage, e-mail it to yourself, whatever ... It's really not that complicated. BitWarden is the above as a service, I reckon. Nb. The above refers to KeePassX. No idea what the KeePass without the x is about. Naming things. So hard.
    • kelvinjps10 5mo ago
      Bitwarden is cloud bases keepass is local
    • justsomehnguy 5mo ago
      It's a program with a file database. No fancy browser plugins, the ability to autotype, the db file could be synced with anything you can sync files. Working search - not sure about BW, but it's opensource implementation (Vaultwarden nowadays?) simply didn't allow to search for the fields you didn't scroll yet to. The biggest problem is lack of multi-edit functionality - you need keep it in mind if you leave somehwere a copy running 24/7.
• busterarm 5mo ago
  For anyone that thinks this is an Edge-specific dunk, Chrome does not hash your passwords and they are cleartext in memory while Chrome is running (which for most users is always).
  • asmosoinio 4mo ago
    Not since 2024 according to this article? As they use DPAPI. Or am I reading this wrong? https://security.googleblog.com/2024/07/improving-security-of-chrome-cookies-on.html https://security.googleblog.com/2024/07/improving-security-o... > In Chrome 127 we are introducing a new protection on Windows that improves on the DPAPI by providing Application-Bound (App-Bound) Encryption primitives. Rather than allowing any app running as the logged in user to access this data, Chrome can now encrypt data tied to app identity, similar to how the Keychain operates on macOS.
  • bobbiechen 5mo ago
    This is generally true of every application that handles sensitive data. Unless you explicitly clear that memory, it's likely to hang around forever. For example, here is a 2019 writeup from KeePassXC with similar notes: https://keepassxc.org/blog/2019-02-21-memory-security/ https://keepassxc.org/blog/2019-02-21-memory-security/ - even though they explicitly clear sensitive data, there is still a window of opportunity. During my time working on confidential computing, we had a variety of demos showing similar attacks against lots of different datastores, scripts, etc. That's just how computers work and your options are very limited if this is part of your threat model (imo just confidential computing and, if you can handle the performance hit, fully-homomorphic encryption).
    • dist-epoch 5mo ago
      Windows already has a secure kernel credential store, they could move the Edge password store there with a bit of effort, minimize the splash damage when you retrieve a single password to send over HTTP from the regular user space. > Credential Guard prevents credential theft attacks by protecting NTLM password hashes, Kerberos Ticket Granting Tickets (TGTs), and credentials stored by applications as domain credentials. > Credential Guard uses Virtualization-based security (VBS) to isolate secrets so that only privileged system software can access them. https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/ https://learn.microsoft.com/en-us/windows/security/identity-...
• dkenyser 5mo ago
  Anyone have a link to the source code for this .exe? Would love to see _how_ it's extracting them.
  • bgrainger 5mo ago
    https://github.com/L1v1ng0ffTh3L4N/Proof-of-Concepts/blob/main/EdgeSavedPasswordsDumper/Program.cs https://github.com/L1v1ng0ffTh3L4N/Proof-of-Concepts/blob/ma...
• thumbsup-_- 5mo ago
  Its Microsoft doing Microsoft things
  • washingupliquid 5mo ago
    Linux stores plenty of passwords in clear text in /etc and $HOME and this is considered acceptable by most users. These same people also believe the TPM is a spy chip.
    • cwillu 5mo ago
      > Linux stores plenty of passwords in plain text in /etc That's gonna be a big ol' [CITATION NEEDED] from me, dawg.
      • SoftTalker 5mo ago
        Wifi passwords in /etc/netplan files, is one I can think of.
      • fragmede 5mo ago
        I haven't solved the problem of sensitive .env files sitting around on my computer.
        • spacemule 5mo ago
          `sops exec-env` I have an alias set for when I'm working with opentofu: `alias tfenter='sops exec-env secrets.yaml "/bin/bash"'` I encrypt with openbao's transit engine and backup age key kept in a password manager, so no secrets live on disk.
    • vondur 5mo ago
      Really in /etc plain text? I could see some random app possibly doing that somewhere in ~/.config, but I don't think Linux itself stores passwords in plain text for systemwide use.
• deleted 5mo ago
  [deleted]
• jmclnx 5mo ago
  In this day and time Microsoft should really know better. But I have seen this, and worse, happen over and over again in some fortune 500 companies with ERP and in-house systems. I would think this is a local vulnerability assuming Windows works as other OSs.
• FuriouslyAdrift 5mo ago
  A reminder that Edge is just Chromium plus some Microsoft hooks for automated SSO.
• jdlyga 5mo ago
  My brain stores all my passwords in memory in clear text too
• nubinetwork 5mo ago
  Yeah, you can probably do the same thing to pam on linux... just attach gdb to openssh or your getty login process.
• timedude 5mo ago
  That's kinda stupid. The passwords could get swapped to disk in the swap file in plaintext when memory is low by the OS.
  • alterom 5mo ago
    You say this as if accessing that file was any easier than accessing memory.
    • mintplant 5mo ago
      If I have a disk image or access to the physical drive, it's trivial. This means they can no longer be considered encrypted at rest.
      • dist-epoch 5mo ago
        If your computer storage is not fully encrypted you have bigger worries than the swap file.
      • munk-a 5mo ago
        If you're on prem or able to manipulate the machine into an OS of your choosing, yes. But with purely remote access to a device the disk is pretty decently secured (even if Window's ACLs are nightmareishly convoluted).
    • dlcarrier 5mo ago
      It is when the computer is off.
      • alterom 5mo ago
        And if you whack someone with a wrench until they tell you the password, it's even easier! Seriously, if someone is getting physical access to the machine to the extent where they can remove the hard drive... I doubt that it makes a difference whether the browser's password manager keeps its passwords encrypted in-memory.
• ylk 5mo ago
  For reference, this is how Google says Chrome stores passwords encrypted in memory and uses an elevated service to prevent other processes from impersonating Chrome and gaining access to the plain text passwords: https://security.googleblog.com/2024/07/improving-security-of-chrome-cookies-on.html https://security.googleblog.com/2024/07/improving-security-o...
  • nitwit005 5mo ago
    That appears to be storage at rest (on disk), rather than in memory.
    • ylk 4mo ago
      You're correct, thank you. Sadly I can't edit my comment anymore. Sorry for the confusion.
  • crummy 5mo ago
    I recall chrome used to let you reveal passwords with a simple button press in the UI. I think their conclusion at the time was if an attacker had local access there was no point in pretending they were hidden.
    • m-schuetz 5mo ago
      I still found it insane to display passwords that easily. Sometimes I give brief access to my PC to friends, family, acquaintances, or even colleagues, and they shouldn't be able to see my passwords with a simple button. It's like leaving your bike out unlocked, because someone with the right tools can break the locks anyway.
      • jeroenhd 5mo ago
        I think it makes perfect sense. I want to see my passwords without having to re-enter my system password every time. Operating systems have had guest accounts for decades for the "handing your PC to friends/family/etc." use case. Even Android phones have temporary guest accounts (though many manufacturers disable that because it interferes with their own secondary user-based hacks).
• fsflover 5mo ago
  I don't understand, who are all these people who care about security and at the same time are using Microsoft Edge. Could someone enlighten me? Does it have some specific features that somebody needs?
  • dev1ycan 5mo ago
    They have what I think is the best implementation of vertical tabs, chrome doesn't even have them, firefox is so far behind it's not even funny anymore... brave's is terrible.
• matof 5mo ago
  Edge is built by a company not focusing on user data-protection, so no surprise here. At least Brave and Firefox are usable and actual competitors, but have a business model based on user security rather than data.
• OptionOfT 5mo ago
  I think in general one should not assume anything in Edge is done correctly. Microsoft Edge is the place where things get tried out my Microsoft, that's why it changes so fast. It has a built-in updater that is not tied to Windows update, and as such they can iterate incredibly fast.
• aslihana 5mo ago
  Correct me if I am wrong but chrome is-at least was- keeping passwords as raw text in Windows too. I got friend's forgotten password from Chrome on 2021 version
  • cj00 5mo ago
    Yeah it's been years but I remember seeing arguments with Google devs saying if someone had access to your local file system, you're already SOL.
    • thewebguyd 5mo ago
      I've always hated that argument. Yes, if someone as access to your local file system, you are already SOL, but if that machine is part of an org, they aren't necessarily SOL except for now those plain text passwords can potentially be used for easier lateral movement to hit other, more privileged accounts (if you had access/had them saved in that password manager). At minimum, those credentials can now be used to phish the rest of your organization. Stopping the spread is just as important as protecting any individual machine.
  • Hikikomori 5mo ago
    Chrome added app bound encryption of cookie files in 2024.
• zx8080 5mo ago
  The only important question is: does Chrome store passwords in the same way as Edge?
  • asmosoinio 4mo ago
    According to this article: No, they use DPAPI https://security.googleblog.com/2024/07/improving-security-of-chrome-cookies-on.html https://security.googleblog.com/2024/07/improving-security-o... > In Chrome 127 we are introducing a new protection on Windows that improves on the DPAPI by providing Application-Bound (App-Bound) Encryption primitives. Rather than allowing any app running as the logged in user to access this data, Chrome can now encrypt data tied to app identity, similar to how the Keychain operates on macOS.
• LunicLynx 5mo ago
  You are absolutely right, having copilot does not help at all here.
• notepad0x90 5mo ago
  mixed feelings on this, edge is supposed to store creds via DPAPI to the most part. you should also really not use password saving feature on edge (or any browser), it exposes you to a lot more threats that you need. But.. saved passwords are not the same thing as "secrets" the browser uses. It has to be able to provide plain text passwords to websites. This is a really bad feature browsers should just not have to begin with, but they do, and I don't see a better way to use this. In the past, they used to store the passwords in sqlite dbs, but now they've moved away from that at least. From an attack perspective, there maybe some instances where you can dump memory, but you can't attach a debugger to the process without getting caught. so it does make a little bit of a difference there, but microsoft will probably tell you this isn't a security boundary that's being crossed. They can store it via DPAPI in lsass, and if lsass isolation is enabled (only on physical computers, default on win11) even SYSTEM privilege won't get you the credentials. But what's the idea here, you have access to the browser, but you can't visit the site the password is saved for to make it "in use" and in plain text, so you can dump the password? I mean, even if you don't have access to the desktop, you can just start msedge.exe with the URL for the site as an argument and trigger the password retrieval. Edge has done a lot to improve credential security, even DPAPI's existence itself is huge. If your research has meat, that's great but I don't see it here. This feels like some "researcher" hyping themselves up to me, but I could be wrong. Also, I really despise how they posted this on twitter, not even considering the political landmine there, I can't see the comments or threads on there without logging in. I can't visit the site on mobile without being redirected to download the app. I just wanted to mention that if you use X as a security professional in this day and age, my opinion of you drops by like 50% immediately. I don't care if you use bluesky, vk, telegram, discord,facebook, threads or whatever else, twitter is the worst place for you to share your work and you should know better.
• AzzyHN 5mo ago
  And firefox stores them unencrypted by default
• pezezin 5mo ago
  The real mistake is that we are still using simple password authentication instead of challenge-response or public key authentication.
• golem14 5mo ago
  Since it's not been clearly stated: One attack vector might be that I step out to the bathroom for 5 minutes without locking computer, and evil hacker just dumps all my passwords before I come back. I think it's worthwhile considering this. There's a reason why password managers ask for a master password or passkey after 10 minutes. Since I thought Chrome relied on an encrypted enclave, it isn't quite feasible to extract passwords easily even with root access. Yes, you shouldn't leave your computer unattended. But that doesn't mean designing products that make exploiting the inevitable slipup fatal.
  • hypercube33 5mo ago
    Did they ever fix PCIe over thunderbolt security? seems like the security for it prompting to enable on plug vanished in 2019...it could read memory in some systems and that probably didn't matter if your machine was locked or not
    • kogepathic 5mo ago
      > Did they ever fix PCIe over thunderbolt security? It seems to depend on whether you're on a desktop or mobile device. [1] > macOS 13 Ventura was released in 2022 and for portable Macs with Apple CPUs Apple introduced a feature known as ‘Accessory Security’ (also known as ‘Restricted Mode’) > By default, portable Macs (i.e. laptops) with an Apple CPU running macOS 13 Ventura or newer version of macOS will require the end user to authenticate and approve a Thunderbolt device when initially connected. > Stationary Macs (i.e. desktops) with an Apple CPU running macOS 13 Ventura or newer version of macOS do NOT implement the ‘Accessory Security’ feature. As a result, Thunderbolt devices will be automatically approved and authenticated when initially connected. Anecdotally, I have had Dell and Lenovo laptops with Thunderbolt and in Linux I had to manually approve each new device before it would function. [2] [1] https://kb.plugable.com/docking-stations-and-video/do-i-need-to-approve-or-authenticate-thunderbolt-devices-when-i-connect-them-to-my-windows-or-mac-computer https://kb.plugable.com/docking-stations-and-video/do-i-need... [2] https://wiki.archlinux.org/title/Thunderbolt#User_device_authorization https://wiki.archlinux.org/title/Thunderbolt#User_device_aut...
• animanoir 5mo ago
  [dead]
• kronks 5mo ago
  [dead]
• peterdemin 5mo ago
  Sorry for off topic, is the situation the same with Safari on MacOS? I have to touch-id every time I fill the password, so it seems like it’s not available in-memory.
  • dlcarrier 4mo ago
    Anything with biometric authentication has to store the password in a recoverable way. The fingerprint sensor isn't repeatable enough to use your fingerprint data to encrypt the password, so all it can do is compare your fingerprint data to stored data, and if it's vaguely similar, give an okay to use a copy of the password it stored. That's on top of a host of reasons why biometric authentication isn't very good security, so if you care at all about your data, just use a password. If you're any good at typing, it's usually just as fast and convenient, anyway. It's slower on a phone, but a randomly-generated four-digit PIN's one-in-ten-thousand security is still better than a fingerprint, and most phones do allow more digits.
• iberator 5mo ago
  That's why each page of the RAM memory should be AES encrypted with a key in hardware... This is the future and I think IBM got such technology like 50 years ago envisioned.
• ivolimmen 5mo ago
  We have an automated task that runs the OWASP plugin (Maven on Java stack) that automatically creates a JIRA issue if there is any issue found. So I pickup the JIRA ticket and look at the CVE. First things first I __READ__ the actual CVE. Score: 7, ok that is bad Hacker can do ANYTHING by using the tmp file on THE ACTUAL MACHINE ... drag to cancel
• pjmlp 5mo ago
  As do almost every microservice out there, by storing credentials in environment variables, an exploit that manages to read container's memory is enough. I keep looking for frameworks that do it the right way, holding critical data encrypted all time, but it isn't a thing most people worry about.
  • kenniskrag 5mo ago
    What's the threat model. Where do you store the decryption key? E.g. if my app needs a db connection I can ask a vault service but I need creds for that. The vault service can rotate the creds very fast but is it addition security.
    • zbentley 4mo ago
      > What's the threat model Malicious code can read some/all memory in your container, but not necessarily execute. Plenty of such vulns exist. > Where do you store the decryption key? Not in memory. Either nowhere after use, on the filesystem, or otherwise accessible on-demand by performing IO.
    • pjmlp 5mo ago
      The treat model is that your container gets owned. The password should only exist in the process memory for the few lines of code to open that database connection, and then wiped after you got the handle. Ideally, homomorphic encryption should be used instead. https://en.wikipedia.org/wiki/Homomorphic_encryption https://en.wikipedia.org/wiki/Homomorphic_encryption
• danborn26 5mo ago
  This seems like a significant oversight for a modern browser. Credential material should be aggressively zeroed out after use to minimize the attack surface.
  • efilife 4mo ago
    llm comment
• AJRF 5mo ago
  I feel like there is a problem with security research where the incentive is to find scary headlines, and things that have very little impact get trotted out as world shattering revelations. This seems like one of those times - feels like an "assume a perfectly spherical cow" moment - if you are at the point where you have access to attempt to read this, the kingdom is already lost?
• rahadbhuiya 5mo ago
  [dead]
• testemailfordg2 5mo ago
  That's interesting, then that UAC prompt asking to enter login credentials to view existing saved password is useless.
• axdecces 4mo ago
  sa