Feeds

Browsers fail password protection tests

Toxic soup of potential vulnerabilities

High performance access to file storage

A beta version of Google Chrome has tied with Safari for last place in tests of how the browsers dealt with password security.

The tests - put together by security consultancy Chapin Information Services - ran the most popular browsers against a set of 21 checks.

None performed particularly well.

Opera 9.62 passed only seven of the 21 tests but that still made it the "joint winner" in an outstandingly mediocre field.

Firefox 3.0.4 also passed a third of the tests while IE 7 scored five out of 21. Bringing up the rear Safari 3.2 for Windows and Goodle Chrome passed just two of the tests.

Curiously Google Chrome was the only browser to pass one test " not filling in a form when auto-complete is set to off".

The tests collectively measured how well browsers kept passwords saved by users safe from phishing fraudsters and malicious hackers, preventing the potential disclosure of online login credentials. The exercise looked at how strong the security architecture of each of the browsers might be without looking in depth at whether these might give rise to vulnerabilities, much less specific exploits.

However a combination of password management and security shortcomings in a browser might be used together to snaffle online login credentials. Chapin singles out three flaws in Chrome, present in the beta, and unfixed in the final version, to illustrate this potential risk.

Chrome fails to check the location of password requests or the destination to which they are dispatched. In addition, invisible form elements can trigger password management functions in the browser without user involvement. "These three problems, combined with seventeen others so far identified in Chrome's password manager, form a toxic soup of potential vulnerabilities that can coalesce into broad insecurity," company founder Richard Chapin warns.

Opera performs the best of the five browsers tested at withstanding this type of attack, which Chapin highlights because he discovered a similar class of vulnerability in version 2 of Firefox two years ago.

Chapin's tests set a high standard but looking at the results it is tempting to think that users would be well advised never to save passwords for sensitive websites.

More details of the tests can be found here. ®

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
OpenSSL Heartbleed: Bloody nose for open-source bleeding hearts
Bloke behind the cockup says not enough people are helping crucial crypto project
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Experian subsidiary faces MEGA-PROBE for 'selling consumer data to fraudster'
US attorneys general roll up sleeves, snap on gloves
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.