Feeds

Chrome, Firefox blab your passwords in a just few clicks: Shrug, wary or kill?

Vote now: Browsers reveal logins on idle PCs, but is it a code flaw or a brain bug?

Secure remote control for conventional and virtual desktops

Poll Web browsers Google Chrome and Mozilla Firefox can reveal the logged-in user's saved website passwords in a few clicks. There now rages a debate over whether this is an alarming security flaw or a common feature.

Picture this: you've been asked to fix a friend's PC because it's stopped printing pages properly, or you saunter past an office colleague's desk and notice her computer has been left unlocked.

If the victim, shall we say, is using Chrome, surf over to chrome://settings/passwords, click on a starred-out saved website password and click on "Show"; rinse and repeat down the list. Voila, you can see his or her passwords in plain text.

Blighty-based programmer Elliott Kember raised the issue this week on his blog and made a persuasive argument that it is a "silly feature" that needs addressing:

In a world where Google promotes its browser on YouTube, in cinema pre-rolls, and on billboards, the clear audience is not developers. It’s the mass market - the users. The overwhelming majority. They don’t know [Chrome] works like this. They don’t expect it to be this easy to see their passwords. Every day, millions of normal, every-day users are saving their passwords in Chrome. This is not OK.

Today, go up to somebody non-technical. Ask to borrow their computer. Visit chrome://settings/passwords and click “show” on a few of the rows. See what they have to say.

Kember wants to Google's browser at least ask users for a password before displaying the credentials in plain text, or warn that they can be accessed in full with a few clicks.

"At this stage, anything would be nice. They're not acknowledging the fact that millions and millions of Chrome users don't understand how this works," he told The Reg. "I'd like to never ever see passwords in plain text without authenticating myself first."

Chrome's team lead Justin Schuh responded by arguing that if a miscreant has physical access to the computer then it's game over anyway, in terms of protecting the user's system. He added:

I appreciate how this appears to a novice, but we've literally spent years evaluating it and have quite a bit of data to inform our position. And while you're certainly well intentioned, what you're proposing is that that we make users less safe than they are today by providing them a false sense of security and encouraging dangerous behaviour. That's just not how we approach security on Chrome.

Some will say the users need some top tips on securing their machines - such as not leaving it unlocked or in the case of a shared computer, not saving passwords. However, worldwide web granddaddy Tim Berners-Lee said the Chrome team's response was "disappointing" in a tweet:

Going back to our earlier scenarios, if the user prefers Firefox, then open Preferences, hit the "Saved passwords" button in the security tab and then press "Show passwords". But bear in mind that a master password can be set to protect credentials stored in Mozilla's browser. The same goes for Opera, which also allows a master password to be set to encrypt the data on disk.

Internet Explorer's saved passwords can be harvested using nimble Registry skills or a suitable third-party tool. And someone's written cross-browser JavaScript to extract saved passwords from an open page.

So now we turn the debate over to you: in the style of shag, marry or kill, select whether you shrugged, felt wary or had the sudden desire to kill over this issue:

JavaScript Disabled

Please Enable JavaScript to use this feature.

And don't forget to comment, of course: what else can mitigate the accidental disclosure of one's privates to a nosy friend? ®

Voting is now closed: thanks for participating. The results are shown.

New hybrid storage solutions

More from The Register

next story
Google recommends pronounceable passwords
Super Chrome goes into battle with Mr Mxyzptlk
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
Snowden, Dotcom, throw bombs into NZ election campaign
Claim of tapped undersea cable refuted by Kiwi PM as Kim claims extradition plot
Reddit wipes clean leaked celeb nudie pics, tells users to zip it
Now we've had all THAT TRAFFIC, we 'deplore' this theft
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
TorrentLocker unpicked: Crypto coding shocker defeats extortionists
Lousy XOR opens door into which victims can shove a foot
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.