This is sort of like saying “I leave my valuables in plain sight by my door because it has a lock on it and door locks are trustworthy.” I’m not super into cyber security and stuff but it seems like one of the most common problems is programs managing to get access to memory they shouldn’t have access to. It seems to happen all the time! Just like many locks for you door are trash.
And yet you and most people use a door with a lock instead of something more secure because… in general they do work well for the purpose they’re trying to serve. Most criminals aren’t master criminals, and master criminals aren’t coming after your house.
I extracted IE6 passwords from hundreds of people when I was 13, for fun. If passwords are now being stored plaintext again, they are going to leak. Some of the people who steal those passwords won’t be doing it just for fun.
“Yeah totally secure! Just trust me!..” basically
This is LITERALLY isn’t secure; they should atleast make it encrypted. This is just the same as using your notes app as password manager! But it’s microsoft, and they’re willingly giving your bitlocker encryption key to the FBIs for your drives. So I’m not surprised…
I feel it may be worse than using your notes app.
A malicious attack doesn’t know which notes app, nor the filename.
This has every browser opening the exact same passwords.txt in root.
phew it’s an expected feature, thank goodness!!!
if they patch this, they should be dragged through the town square after that comment
You guys are using edge?
Edge is on my computer, and I can’t delete it, at least not with my limited IT experience. It’s buried deep in the operating system, and it opens up seemingly randomly, I use firefox.
Looking online about getting rid of it, others described it as cancer.
It’s not that hard, all you need is usb drive and choosing a distro (the hard step)
Not sure how it works in Win11 but historically it has not been possible to remove Internet Explorer or Edge from Windows.
How will the NSA spy on you if Microsoft doesn’t hand them your passwords?
Everytime I read a Microsoft headline these days
That’s the added trust and security they always boast about
trust is multiplicative, not additive
Trust me bro
Safety and security are foundational to Microsoft Edge. Access to browser data as described in the reported scenario would require the device to already be compromised. Design choices in this area involve balancing performance, usability, and security, and we continue to review it against evolving threats.
“We value user safety and usability, but if you’re already compromised you can go fuck yourself”
No, if you are already compromised there is just no way anyone can help you anymore besides wiping your whole system.
True, but there’s a big fucking difference between handing over the keys without being asked, and doing basic fucking due diligence and not loading all your passwords in plain text into memory by default.
(@[email protected] ) I can’t defend MicroSlop because that mentality is pants on head stupid and is directly in opposition to any statement that they care about security. Because, again, they made their browser behave this way for no real reason besides blowing smoke up our ass. Chromium handles passwords properly, MicroSlop chose to do it insecurely and is hiding behind the dumbest defense. Because their OS has more holes than Swiss cheese and they refuse to plug a basic security hole that they put there intentionally.
Chrome’s handling is barely more secure. A compromised device will have a much easier time reading Chrome’s encrypted store than scanning your RAM to find passwords.
Remember that if you don’t need to input a password to open the store, then anything with access to your device can also read it.
Wether it’s encrypted in your RAM or not barely makes any difference in how difficult the task is.
The only solution is: Browsers should require a password. Or even better: Use a dedicated, properly secured password manager.
Chrome’s handling is barely more secure. A compromised device will have a much easier time reading Chrome’s encrypted store than scanning your RAM to find passwords.
Regardless, they’re still loading them into memory in plain text, and knowing this exists, is going to be an easier task to grab than dealing with the encrypted store chromium uses. At least chromium uses the in built credential api to try to protect the secrets, the fact edge doesn’t is an egregious security hole.
I don’t disagree that users need to have to enter a password to view their stored passwords, but you’re hand waving a massive and intentional decrease in security on Edge’s part. No matter how easy it is to get out of another browser, this is a violation of basic secure development practices. Security is only as strong as the weakest link, and edge is determined to not even close one of the easiest links in the chain.
I will disagree on the RAM scanning being easier. It is my opinion that the weakest link here is the password store.
The security hole here is a password management system that can work without external secret. It is shocking that this is still common practice and that people use them.
Yeah, I can’t believe I’m defending Microsoft but that’s probably what they meant. No browser password saving feature is safe if your device is compromised.
Use a proper encrypted password manager
M365 chat also fetches a copy of whatever secured file links you send to each other. Goes without saying, but never use Microsoft products if you value security.
I haven’t used a Microsoft browser or operating syatem in almost 25 years.
aside from when i was working in IT, same. My personal devices are linux or macos.
I’ve actually never met a vegan who acts like this… linux users however
Microsoft SSH agent persistently stores your unencrypted private keys in the registry. They’re still there unlocked and usable after you reboot.
God, the final comment in that thread makes my blood boil.
That is infuriating. Leaving those keys available to the user means that worms can later use you to compromise additional machines. It turns a local problem into a much bigger one. There’s a recursive script out there that automatically scans your ssh files and attempts to access all hosts in your history…name escapes me at the moment.
Right there in the name, it says Secure She’ll Hades
Nothing in this timeline surprises me any more.
Lucky. I have surprise fatigue lol
I just can’t be indifferent to reading news like “US To Start Firing Unspayed and Neutered Dogs Into The Ocean From Florida Coast”
Ha!
I don’t worry, I just don’t use Edge or Windows or any MS software really (except for Teams at work)
Teams at work
Same here. Boss still thinks he’s funny bashing Apple products as a MS fanboy 🙄
