Feeds

Chrome, Firefox blab your passwords in a just few clicks: Shrug, wary or kill?

Vote now: Browsers reveal logins on idle PCs, but is it a code flaw or a brain bug?

SANS - Survey on application security programs

Poll Web browsers Google Chrome and Mozilla Firefox can reveal the logged-in user's saved website passwords in a few clicks. There now rages a debate over whether this is an alarming security flaw or a common feature.

Picture this: you've been asked to fix a friend's PC because it's stopped printing pages properly, or you saunter past an office colleague's desk and notice her computer has been left unlocked.

If the victim, shall we say, is using Chrome, surf over to chrome://settings/passwords, click on a starred-out saved website password and click on "Show"; rinse and repeat down the list. Voila, you can see his or her passwords in plain text.

Blighty-based programmer Elliott Kember raised the issue this week on his blog and made a persuasive argument that it is a "silly feature" that needs addressing:

In a world where Google promotes its browser on YouTube, in cinema pre-rolls, and on billboards, the clear audience is not developers. It’s the mass market - the users. The overwhelming majority. They don’t know [Chrome] works like this. They don’t expect it to be this easy to see their passwords. Every day, millions of normal, every-day users are saving their passwords in Chrome. This is not OK.

Today, go up to somebody non-technical. Ask to borrow their computer. Visit chrome://settings/passwords and click “show” on a few of the rows. See what they have to say.

Kember wants to Google's browser at least ask users for a password before displaying the credentials in plain text, or warn that they can be accessed in full with a few clicks.

"At this stage, anything would be nice. They're not acknowledging the fact that millions and millions of Chrome users don't understand how this works," he told The Reg. "I'd like to never ever see passwords in plain text without authenticating myself first."

Chrome's team lead Justin Schuh responded by arguing that if a miscreant has physical access to the computer then it's game over anyway, in terms of protecting the user's system. He added:

I appreciate how this appears to a novice, but we've literally spent years evaluating it and have quite a bit of data to inform our position. And while you're certainly well intentioned, what you're proposing is that that we make users less safe than they are today by providing them a false sense of security and encouraging dangerous behaviour. That's just not how we approach security on Chrome.

Some will say the users need some top tips on securing their machines - such as not leaving it unlocked or in the case of a shared computer, not saving passwords. However, worldwide web granddaddy Tim Berners-Lee said the Chrome team's response was "disappointing" in a tweet:

Going back to our earlier scenarios, if the user prefers Firefox, then open Preferences, hit the "Saved passwords" button in the security tab and then press "Show passwords". But bear in mind that a master password can be set to protect credentials stored in Mozilla's browser. The same goes for Opera, which also allows a master password to be set to encrypt the data on disk.

Internet Explorer's saved passwords can be harvested using nimble Registry skills or a suitable third-party tool. And someone's written cross-browser JavaScript to extract saved passwords from an open page.

So now we turn the debate over to you: in the style of shag, marry or kill, select whether you shrugged, felt wary or had the sudden desire to kill over this issue:

JavaScript Disabled

Please Enable JavaScript to use this feature.

And don't forget to comment, of course: what else can mitigate the accidental disclosure of one's privates to a nosy friend? ®

Voting is now closed: thanks for participating. The results are shown.

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Arts and crafts store Michaels says 3 million credit cards exposed in breach
Meanwhile, Target investigators prepare for long process in nabbing hackers
Canadian taxman says hundreds pierced by Heartbleed SSL skewer
900 social insurance numbers nicked, says revenue watchman
prev story

Whitepapers

SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.