This feels like a case of "It rather involved being on the other side of this airtight hatchway"[1]. If you can read arbitrary process memory, you're probably also in a position to just dump out the passwords by pretending to be the user in question.<p>> If an attacker gains administrative access on a terminal server, they can access the memory of all logged‑on user processes.<p>If an attacker has administrative access, they can also attach a debugger to every chrome process and force it to decrypt all the passwords. The only difference this really makes is in coldboot attacks, but even then it's still not clear whether it makes the attacker's job slightly easier, or allows an attack that's otherwise not possible.<p>[1] <a href="https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31283" rel="nofollow">https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31...</a>
Reading arbitrary process memory can be done as a standard user. No admin needed. Any Win32 program can do it. You just can't access the memory from processes that are admin-level.
Security isn't black and white. If i leave a post-it note of my logins on my monitor, that's definitely less safe than in a unlocked drawer, and so on.
There's little hope of protecting against a snooper seeing the passwords you actually use, since they have to exist in plaintext at some point. But there's no reason to expose <i>the entire password database when no passwords are even being used</i>.
This is 100% that case. Basically every form (like this very one I'm typing in) is held in userspace memory un-encrypted. And yet lawyers and doctors and CIA operatives all use forms to type very sensitive stuff in.<p>It would be stupid, wasteful, and overly-complex to encrypt forms just in case some malicious process somehow got ring0 access. In that case, a keylogger is likely more useful anyway. And you're fucked even if you <i>are</i> encrypting stuff (as keys are likely also somewhere in memory[1] and they need to be—gasp—unencrypted). There's no free lunch.<p>Stupid Twitter thread meant to rage-bait for engagement.<p>[1] They could also be on disk or on some peripheral, but still fully readable by a motivated-enough hacker.
Does this tool access an Edge instance running on the same machine? Couldn't you then just simply export all saved passwords anyway?<p><a href="https://support.microsoft.com/en-us/topic/export-passwords-in-microsoft-edge-15c0b4f5-e490-4034-b699-1063bad0cc2d" rel="nofollow">https://support.microsoft.com/en-us/topic/export-passwords-i...</a>
Password managers often go through quite some hassle to keep passwords 'safe' in memory. However, I often do not get the attack model of many of those tools. Tools like keepass e.g. go through quite to register a browser plugin. But then anyone with normal user rights can extract that key from the browser and do everything with it. Also this whole 'trust this browser' stuff of web apps seems strange if one e.g. can read the cookie store easily...
<a href="https://xcancel.com/L1v1ng0ffTh3L4N/status/2051308329880719730" rel="nofollow">https://xcancel.com/L1v1ng0ffTh3L4N/status/20513083298807197...</a>
Anyone have a link to the source code for this .exe? Would love to see _how_ it's extracting them.
To be fair, 'loads into memory' and 'stores' are not the same thing.
Its Microsoft doing Microsoft things
Please use a dedicated password manager, instead of a browser-based one. KeePass is likely the best going forward.
@taviso had claimed the exact opposite: <a href="https://lock.cmpxchg8b.com/passmgrs.html" rel="nofollow">https://lock.cmpxchg8b.com/passmgrs.html</a><p>EDIT: Yes, he claimed that for online password managers, not keepass. I thought the argument was about password managers in general.
Where?<p>> <i>Good examples of simple and safe password managers are keepass and keepassx</i>
Browser-based password management serves the purpose of locking users into a specific browser; I'd much rather have the freedom to switch browsers at will without the cognitive tax of <i>securely</i> moving all my creds every time I want to switch my main browser.
That's not what that is saying. It's saying don't use an _online_ password manager instead of the browser one. In the very opening they state that simple implementations are great and even lists some. Then the rest of the article dives specifically into online password managers, which are something else.
Out of curiosity, why KeePass versus Bitwarden? I've been using Bitwarden for years, but if there's a specific reason I should be using KeePass instead, I'm open to changing.
KeePass is just an encrypted database file with UI around it for usability. You can keep the db on a USB drive, sync it through a cloud storage, e-mail it to yourself, whatever ... It's really not that complicated. BitWarden is the above as a service, I reckon.<p>Nb. The above refers to KeePassX. No idea what the KeePass without the x is about.
Naming things. So hard.
Bitwarden has taken investor money, sadly. It's still in good shape for the moment. But the time will come when they place profits above other needs; it's a matter of when, not if.
If it is a process, running in the same user context, with the ability to read/dump arbitrary memory -- As the KeePass database is decrypted it would "store all passwords in memory in plain text" too.<p>The fix isn't Edge Vs. Chrome. Vs KeePass Vs. Bitwarden, it is "How do I have my passwords exist in a different execution context than [evil process able to read all memory]?"<p>Android and iOS have an "answer" to this problem. Desktop OSs having all processes running side by side in the user's execution context, do not. It is only as secure as the least secure process running.
For anyone that thinks this is an Edge-specific dunk, Chrome does not hash your passwords and they are cleartext in memory while Chrome is running (which for most users is always).
Password hashes are one-directional lossy storage. If a password manager "hashed your password" it would be essentially deleting your password and replacing it with something else which cannot be used to log into anything. The password MUST be recoverable to plain-text to replay it to a website.<p>But you're correct that Chrome, Firefox, Edge, Lastpass, BitWarden, even Keepass have the same issue. It is an Operating System limitation, not a password manager problem.
This is generally true of every application that handles sensitive data. Unless you explicitly clear that memory, it's likely to hang around forever.<p>For example, here is a 2019 writeup from KeePassXC with similar notes: <a href="https://keepassxc.org/blog/2019-02-21-memory-security/" rel="nofollow">https://keepassxc.org/blog/2019-02-21-memory-security/</a> - even though they explicitly clear sensitive data, there is still a window of opportunity.<p>During my time working on confidential computing, we had a variety of demos showing similar attacks against lots of different datastores, scripts, etc. That's just how computers work and your options are very limited if this is part of your threat model (imo just confidential computing and, if you can handle the performance hit, fully-homomorphic encryption).
Why wouldn't it? What else would you expect from the p̶e̶o̶p̶l̶e̶ masochists who subjected us to internet explorer