Author Topic: Chrome, Firefox blab your passwords in a few clicks  (Read 511 times)

Offline thaiga

  • Korat forum specialist
  • *****
  • Posts: 16097
Chrome, Firefox blab your passwords in a few clicks
« on: August 08, 2013, 01:24:05 PM »
Web browsers Google Chrome and Mozilla Firefox can reveal the logged-in user's saved website passwords in a few clicks. There now rages a debate over whether this is an alarming security flaw or a common feature.

Picture this: you've been asked to fix a friend's PC because it's stopped printing pages properly, or you saunter past an office colleague's desk and notice her computer has been left unlocked.

If the victim, shall we say, is using Chrome, surf over to chrome://settings/passwords, click on a starred-out saved website password and click on "Show"; rinse and repeat down the list. Voila, you can see his or her passwords in plain text.

Blighty-based programmer Elliott Kember first raised the issue on his blog and made a persuasive argument that it is a bug that needs fixing:

In a world where Google promotes its browser on YouTube, in cinema pre-rolls, and on billboards, the clear audience is not developers. It’s the mass market - the users. The overwhelming majority. They don’t know [Chrome] works like this. They don’t expect it to be this easy to see their passwords. Every day, millions of normal, every-day users are saving their passwords in Chrome. This is not OK.
Today, go up to somebody non-technical. Ask to borrow their computer. Visit chrome://settings/passwords and click “show” on a few of the rows. See what they have to say.

Kember wants to Google's browser at least ask users for a password before displaying the credentials in plain text, or warn that they can be accessed in full with a few clicks.

"At this stage, anything would be nice. They're not acknowledging the fact that millions and millions of Chrome users don't understand how this works," he told The Reg. "I'd like to never ever see passwords in plain text without authenticating myself first."

Chrome's team lead Justin Schuh responded by arguing that if a miscreant has physical access to the computer then it's game over anyway, in terms of protecting the user's system. He added:

I appreciate how this appears to a novice, but we've literally spent years evaluating it and have quite a bit of data to inform our position. And while you're certainly well intentioned, what you're proposing is that that we make users less safe than they are today by providing them a false sense of security and encouraging dangerous behaviour. That's just not how we approach security on Chrome.

Some will say the users need some top tips on securing their machines - such as not leaving it unlocked or in the case of a shared computer, not saving passwords.

However, worldwide web granddaddy Tim Berners-Lee said the Chrome team's response was "disappointing" in a tweet:

READ MORE theregister.co.uk


Anyone who goes to a psychiatrist should have his head examined.

Offline Baby Farts

  • Korat forum specialist
  • *****
  • Posts: 3338
  • Seeek!
Re: Chrome, Firefox blab your passwords in a few clicks
« Reply #1 on: August 09, 2013, 09:01:44 AM »
I fix my own PC, but yeah you can see the passwords.

 



Thailand