Microsoft Edge stores all passwords in memory in clear text, even when unused

This feels like a case of "It rather involved being on the other side of this airtight hatchway"[1]. If you can read arbitrary process memory, you're probably also in a position to just dump out the passwords by pretending to be the user in question.

> If an attacker gains administrative access on a terminal server, they can access the memory of all logged‑on user processes.

If an attacker has administrative access, they can also attach a debugger to every chrome process and force it to decrypt all the passwords. The only difference this really makes is in coldboot attacks, but even then it's still not clear whether it makes the attacker's job slightly easier, or allows an attack that's otherwise not possible.

[1] https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31...

For reference, this is how Google says Chrome stores passwords encrypted in memory and uses an elevated service to prevent other processes from impersonating Chrome and gaining access to the plain text passwords: https://security.googleblog.com/2024/07/improving-security-o...

Since it's not been clearly stated: One attack vector might be that I step out to the bathroom for 5 minutes without locking computer, and evil hacker just dumps all my passwords before I come back.

I think it's worthwhile considering this. There's a reason why password managers ask for a master password or passkey after 10 minutes. Since I thought Chrome relied on an encrypted enclave, it isn't quite feasible to extract passwords easily even with root access.

Yes, you shouldn't leave your computer unattended. But that doesn't mean designing products that make exploiting the inevitable slipup fatal.

Does this tool access an Edge instance running on the same machine? Couldn't you then just simply export all saved passwords anyway?

https://support.microsoft.com/en-us/topic/export-passwords-i...

Yeah, you can probably do the same thing to pam on linux... just attach gdb to openssh or your getty login process.

Anyone have a link to the source code for this .exe? Would love to see _how_ it's extracting them.

The real mistake is that we are still using simple password authentication instead of challenge-response or public key authentication.

To be fair, 'loads into memory' and 'stores' are not the same thing.

Correct me if I am wrong but chrome is-at least was- keeping passwords as raw text in Windows too. I got friend's forgotten password from Chrome on 2021 version

That's kinda stupid. The passwords could get swapped to disk in the swap file in plaintext when memory is low by the OS.

The only important question is: does Chrome store passwords in the same way as Edge?

mixed feelings on this, edge is supposed to store creds via DPAPI to the most part. you should also really not use password saving feature on edge (or any browser), it exposes you to a lot more threats that you need.

But.. saved passwords are not the same thing as "secrets" the browser uses. It has to be able to provide plain text passwords to websites. This is a really bad feature browsers should just not have to begin with, but they do, and I don't see a better way to use this.

In the past, they used to store the passwords in sqlite dbs, but now they've moved away from that at least.

From an attack perspective, there maybe some instances where you can dump memory, but you can't attach a debugger to the process without getting caught. so it does make a little bit of a difference there, but microsoft will probably tell you this isn't a security boundary that's being crossed. They can store it via DPAPI in lsass, and if lsass isolation is enabled (only on physical computers, default on win11) even SYSTEM privilege won't get you the credentials.

But what's the idea here, you have access to the browser, but you can't visit the site the password is saved for to make it "in use" and in plain text, so you can dump the password? I mean, even if you don't have access to the desktop, you can just start msedge.exe with the URL for the site as an argument and trigger the password retrieval.

Edge has done a lot to improve credential security, even DPAPI's existence itself is huge. If your research has meat, that's great but I don't see it here.

This feels like some "researcher" hyping themselves up to me, but I could be wrong.

Also, I really despise how they posted this on twitter, not even considering the political landmine there, I can't see the comments or threads on there without logging in. I can't visit the site on mobile without being redirected to download the app. I just wanted to mention that if you use X as a security professional in this day and age, my opinion of you drops by like 50% immediately. I don't care if you use bluesky, vk, telegram, discord,facebook, threads or whatever else, twitter is the worst place for you to share your work and you should know better.

And firefox stores them unencrypted by default

Edge is built by a company not focusing on user data-protection, so no surprise here. At least Brave and Firefox are usable and actual competitors, but have a business model based on user security rather than data.

You are absolutely right, having copilot does not help at all here.

A reminder that Edge is just Chromium plus some Microsoft hooks for automated SSO.

In this day and time Microsoft should really know better. But I have seen this, and worse, happen over and over again in some fortune 500 companies with ERP and in-house systems.

I would think this is a local vulnerability assuming Windows works as other OSs.

For anyone that thinks this is an Edge-specific dunk, Chrome does not hash your passwords and they are cleartext in memory while Chrome is running (which for most users is always).

Please use a dedicated password manager, instead of a browser-based one. KeePass is likely the best going forward.

I don't understand, who are all these people who care about security and at the same time are using Microsoft Edge. Could someone enlighten me? Does it have some specific features that somebody needs?

Its Microsoft doing Microsoft things

My brain stores all my passwords in memory in clear text too

Why wouldn't it? What else would you expect from the p̶e̶o̶p̶l̶e̶ masochists who subjected us to internet explorer

I think in general one should not assume anything in Edge is done correctly. Microsoft Edge is the place where things get tried out my Microsoft, that's why it changes so fast. It has a built-in updater that is not tied to Windows update, and as such they can iterate incredibly fast.

The real mistake is that we are still using simple password authentication instead of challenge-response or public key authentication.

A reminder that Edge is just Chromium plus some Microsoft hooks for automated SSO.

In this day and time Microsoft should really know better. But I have seen this, and worse, happen over and over again in some fortune 500 companies with ERP and in-house systems.

I would think this is a local vulnerability assuming Windows works as other OSs.

> If an attacker gains administrative access on a terminal server, they can access the memory of all logged‑on user processes.

[1] https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31...

Anyone have a link to the source code for this .exe? Would love to see _how_ it's extracting them.

Correct me if I am wrong but chrome is-at least was- keeping passwords as raw text in Windows too. I got friend's forgotten password from Chrome on 2021 version

Does this tool access an Edge instance running on the same machine? Couldn't you then just simply export all saved passwords anyway?

https://support.microsoft.com/en-us/topic/export-passwords-i...

This logic is perfectly aligned with the Chromium threat model. Once an attacker gains administrator access, it is game over by definition.

I doubt this is an Edge-specific issue. Microsoft has no interest in making their browser less secure than its upstream.

> Why aren‘t physically-local attacks in Chrome’s threat model?

> We consider these attacks outside Chrome's threat model, because there is no way for Chrome (or any application) to defend against a malicious user who has managed to log into your device as you, or who can run software with the privileges of your operating system user account. Such an attacker can modify executables and DLLs, change environment variables like PATH, change configuration files, read any data your user account owns, email it to themselves, and so on. Such an attacker has total control over your device, and nothing Chrome can do would provide a serious guarantee of defense. This problem is not special to Chrome — all applications must trust the physically-local user.

https://chromium.googlesource.com/chromium/src/+/148.0.7778....

In recent years we've also had browser-exploitable vulnerabilities that allowed reading arbitrary memory as a regular user, but slowly or without full control over the locations. I think wiping credentials as soon as possible after use is a very sensible precaution, even if it's only a moat.

Security isn't black and white. If i leave a post-it note of my logins on my monitor, that's definitely less safe than in a unlocked drawer, and so on.

Agreed. I keep seeing "high priority" "vulns" that require so much system access to actually exploit that they become pointless. If an untrusted process can read your memory or run as an administrator you have already lost.

It honestly feels like more and more "security" people and businesses have less interest in actually securing systems and more in marketing themselves and their business hence the tendency to make every niche attack into a five alarm fire.

Have we already forgotten Cloudbleed [0]?

[0] https://en.wikipedia.org/wiki/Cloudbleed

All true, but it is still bad style. There is no need to keep decrypted passwords in memory the user hasn’t even used in the session (or after they logged in to a certain website).

So as a user, when I go to paste any password, I first need to log in with biometrics, yet any random user process can just snag the password from memory?

What am I missing here?

So you're saying it's an Edge case?

Yeah because Meltdown and Spectre [0] weren't a thing.

[0] https://spectreattack.com/

Reading arbitrary process memory can be done as a standard user. No admin needed. Any Win32 program can do it. You just can't access the memory from processes that are admin-level.

The only important question is: does Chrome store passwords in the same way as Edge?

My brain stores all my passwords in memory in clear text too

In the past, they used to store the passwords in sqlite dbs, but now they've moved away from that at least.

Edge has done a lot to improve credential security, even DPAPI's existence itself is huge. If your research has meat, that's great but I don't see it here.

This feels like some "researcher" hyping themselves up to me, but I could be wrong.

And firefox stores them unencrypted by default

You are absolutely right, having copilot does not help at all here.

Yeah, you can probably do the same thing to pam on linux... just attach gdb to openssh or your getty login process.

Why wouldn't it? What else would you expect from the p̶e̶o̶p̶l̶e̶ masochists who subjected us to internet explorer

Yeah it's been years but I remember seeing arguments with Google devs saying if someone had access to your local file system, you're already SOL.

Chrome added app bound encryption of cookie files in 2024.

Password managers often go through quite some hassle to keep passwords 'safe' in memory. However, I often do not get the attack model of many of those tools. Tools like keepass e.g. go through quite to register a browser plugin. But then anyone with normal user rights can extract that key from the browser and do everything with it. Also this whole 'trust this browser' stuff of web apps seems strange if one e.g. can read the cookie store easily...

For anyone that thinks this is an Edge-specific dunk, Chrome does not hash your passwords and they are cleartext in memory while Chrome is running (which for most users is always).

Password hashes are one-directional lossy storage. If a password manager "hashed your password" it would be essentially deleting your password and replacing it with something else which cannot be used to log into anything. The password MUST be recoverable to plain-text to replay it to a website.

But you're correct that Chrome, Firefox, Edge, Lastpass, BitWarden, even Keepass have the same issue. It is an Operating System limitation, not a password manager problem.

This is generally true of every application that handles sensitive data. Unless you explicitly clear that memory, it's likely to hang around forever.

For example, here is a 2019 writeup from KeePassXC with similar notes: https://keepassxc.org/blog/2019-02-21-memory-security/ - even though they explicitly clear sensitive data, there is still a window of opportunity.

During my time working on confidential computing, we had a variety of demos showing similar attacks against lots of different datastores, scripts, etc. That's just how computers work and your options are very limited if this is part of your threat model (imo just confidential computing and, if you can handle the performance hit, fully-homomorphic encryption).

Please use a dedicated password manager, instead of a browser-based one. KeePass is likely the best going forward.

@taviso had claimed the exact opposite: https://lock.cmpxchg8b.com/passmgrs.html

EDIT: Yes, he claimed that for online password managers, not keepass. I thought the argument was about password managers in general.

Out of curiosity, why KeePass versus Bitwarden? I've been using Bitwarden for years, but if there's a specific reason I should be using KeePass instead, I'm open to changing.

If it is a process, running in the same user context, with the ability to read/dump arbitrary memory -- As the KeePass database is decrypted it would "store all passwords in memory in plain text" too.

The fix isn't Edge Vs. Chrome. Vs KeePass Vs. Bitwarden, it is "How do I have my passwords exist in a different execution context than [evil process able to read all memory]?"

Android and iOS have an "answer" to this problem. Desktop OSs having all processes running side by side in the user's execution context, do not. It is only as secure as the least secure process running.

I recall chrome used to let you reveal passwords with a simple button press in the UI. I think their conclusion at the time was if an attacker had local access there was no point in pretending they were hidden.

That appears to be storage at rest (on disk), rather than in memory.

Since it's not been clearly stated: One attack vector might be that I step out to the bathroom for 5 minutes without locking computer, and evil hacker just dumps all my passwords before I come back.

Yes, you shouldn't leave your computer unattended. But that doesn't mean designing products that make exploiting the inevitable slipup fatal.

Did they ever fix PCIe over thunderbolt security? seems like the security for it prompting to enable on plug vanished in 2019...it could read memory in some systems and that probably didn't matter if your machine was locked or not

That's kinda stupid. The passwords could get swapped to disk in the swap file in plaintext when memory is low by the OS.

You say this as if accessing that file was any easier than accessing memory.

To be fair, 'loads into memory' and 'stores' are not the same thing.

The headline here says "stores in memory", which sounds pretty much identical to me. Can you elaborate on what you consider the difference between "loading" and "storing" into memory?

Tbf the point of the post is the "even when unused" part. A memory store is still a store.

Its Microsoft doing Microsoft things

Linux stores plenty of passwords in clear text in /etc and $HOME and this is considered acceptable by most users. These same people also believe the TPM is a spy chip.

They have what I think is the best implementation of vertical tabs, chrome doesn't even have them, firefox is so far behind it's not even funny anymore... brave's is terrible.

So you're saying it's an Edge case?

Have we already forgotten Cloudbleed [0]?

[0] https://en.wikipedia.org/wiki/Cloudbleed

All true, but it is still bad style. There is no need to keep decrypted passwords in memory the user hasn’t even used in the session (or after they logged in to a certain website).

So as a user, when I go to paste any password, I first need to log in with biometrics, yet any random user process can just snag the password from memory?

What am I missing here?

I wonder about those kinds of exploits that sit on a webpage, but what stops someone from injecting their payload on a sites login page? JS can grab the password in plaintext in such a scenario, at which point the password manager does not save you. Can we normalize Passkey more?

It's surprisingly hard to do the compiler or cpu may see a write without a read and optimize it away. Windows has a SecureZeroMemory and a few other barrier primitives but not all languages reach to it

Many of them also have vested interests in furthering corporate authoritarianism, which is why letting users have full control over their devices is considered a security risk to them.

This logic is perfectly aligned with the Chromium threat model. Once an attacker gains administrator access, it is game over by definition.

I doubt this is an Edge-specific issue. Microsoft has no interest in making their browser less secure than its upstream.

> Why aren‘t physically-local attacks in Chrome’s threat model?

https://chromium.googlesource.com/chromium/src/+/148.0.7778....

> I doubt this is an Edge-specific issue.

It absolutely ain't Edge-specific. Firefox (AFAICT) also keeps stored passwords in clear-text unless encrypted with a passphrase (which is not the default on desktop; on Android there's a fingerprint/PIN check to access them, but I don't know offhand if there's any encryption involved with that).

Really this is true of most credentials stored within applications; unless you're providing a decryption key on open (whether explicitly or on OS-level login using some keychain mechanism), the stored credentials are probably plaintext.

It's a very standard defense-in-depth technique to put secrets between guard pages and only make the secret page readable when needed. That way any inadvertent access, be it programming error or exploit, simply causes a segfault, unless it's raced with a valid access (in a multithreaded or shm context) or the exploit explicitly changed the permission bits. Most memory disclosure vulnerabilities don't allow you to do that.

That being said any single password, when used, passes through so many layers and components that it's likely impossible to even just wipe the contaminated memory locations. But that's fine, the password database is opened for most of the browser's lifetime, any given password actively being used is a rare event in comparison.

>> Microsoft has no interest in making their browser less secure than its upstream.

Microsoft has every interest in spending as little money as possible on edge, just enough to keep people swalling the tripe. User privacy is not a thing at MS and hasnt been for decades. Plaintext passwords in a MS product is just another monday. It will take decades more to convince me they have changed.

Come on, they could still get a blood sample to really verify that its the user

Security isn't black and white. If i leave a post-it note of my logins on my monitor, that's definitely less safe than in a unlocked drawer, and so on.

If I leave a post-it note of passwords on my monitor inside a vault to which only I have access, it’s not a big deal. That’s the point of the “airtight hatch” metaphor.

> If i leave a post-it note of my logins on my monitor, that's definitely less safe than in a unlocked drawer, and so on.

Having passwords on post-it notes does make certain types of attacks much easier. For instance, coworkers hacking other coworkers, or people burglarizing the office. None of which really apply to the "If an attacker gains administrative access on a terminal server" scenario.

Continuing the analogy, what Edge is doing is like leaving cash in unlocked cabinets inside a vault, and what Chrome's doing is locking those cabinets with a padlock. Sure, having the padlocks makes the cash more secure, but if someone went through all the effort into breaking the vault (terminal server), a padlock probably isn't going to stop them. This is especially true nowadays with AI coding agents and ready-made stealers available for sale online.

The way to think about security is as a system of layers, each of which filters out ever more sophisticated attackers.

We should care about all kinds of attackers, and not assume that the protections against the most sophisticated will obviate the protections against the least sophisticated.

Okay. Can you describe an attack / threat model where it would matter in this particular case?

But you're correct that Chrome, Firefox, Edge, Lastpass, BitWarden, even Keepass have the same issue. It is an Operating System limitation, not a password manager problem.

I think the catch is whether the passwords are unencrypted in memory constantly, or only during a short period when the password is being used?

I never said that they should be hashed, just that they aren't. Just subtly pointing out what the tradeoffs are if you choose to use a password manager whose storage/access is basically always available.

At least with Keepass it's locked in an encrypted store and only available exactly when I need it to be. I can take other precautions if I want when I want to access it.

With your browser's password manager you're stuck with the slop you were given.

This is generally true of every application that handles sensitive data. Unless you explicitly clear that memory, it's likely to hang around forever.

Windows already has a secure kernel credential store, they could move the Edge password store there with a bit of effort, minimize the splash damage when you retrieve a single password to send over HTTP from the regular user space.

> Credential Guard prevents credential theft attacks by protecting NTLM password hashes, Kerberos Ticket Granting Tickets (TGTs), and credentials stored by applications as domain credentials.

> Credential Guard uses Virtualization-based security (VBS) to isolate secrets so that only privileged system software can access them.

https://learn.microsoft.com/en-us/windows/security/identity-...

Out of curiosity, why KeePass versus Bitwarden? I've been using Bitwarden for years, but if there's a specific reason I should be using KeePass instead, I'm open to changing.

KeePass is just an encrypted database file with UI around it for usability. You can keep the db on a USB drive, sync it through a cloud storage, e-mail it to yourself, whatever ... It's really not that complicated. BitWarden is the above as a service, I reckon.

Nb. The above refers to KeePassX. No idea what the KeePass without the x is about. Naming things. So hard.

Bitwarden is cloud bases keepass is local

It's a program with a file database.

No fancy browser plugins, the ability to autotype, the db file could be synced with anything you can sync files.

Working search - not sure about BW, but it's opensource implementation (Vaultwarden nowadays?) simply didn't allow to search for the fields you didn't scroll yet to.

The biggest problem is lack of multi-edit functionality - you need keep it in mind if you leave somehwere a copy running 24/7.

Bitwarden has taken investor money, sadly. It's still in good shape for the moment. But the time will come when they place profits above other needs; it's a matter of when, not if.

The fix isn't Edge Vs. Chrome. Vs KeePass Vs. Bitwarden, it is "How do I have my passwords exist in a different execution context than [evil process able to read all memory]?"

Windows 11* and MacOS also do the job as long as you're using hardware bound passkeys.

* I don't want to speak past my own experience so checking my work, Windows can store passkeys in a TPM if available but falls back to storing on disk... https://helgeklein.com/blog/checking-windows-hello-for-busin...

This makes me miss running Qubes a few years ago, and keeping BitWarden in a separate VM from everything else. I've never felt as secure as when I had that setup.

> Credential Guard prevents credential theft attacks by protecting NTLM password hashes, Kerberos Ticket Granting Tickets (TGTs), and credentials stored by applications as domain credentials.

> Credential Guard uses Virtualization-based security (VBS) to isolate secrets so that only privileged system software can access them.

https://learn.microsoft.com/en-us/windows/security/identity-...

I'm pretty sure macOS is more like iOS in this respect. At the very least, the passwords are typically secured biometrically and only the one being used is actually decrypted at the time of use.

@taviso had claimed the exact opposite: https://lock.cmpxchg8b.com/passmgrs.html

EDIT: Yes, he claimed that for online password managers, not keepass. I thought the argument was about password managers in general.

Where?

> Good examples of simple and safe password managers are keepass and keepassx

That's not what that is saying. It's saying don't use an _online_ password manager instead of the browser one. In the very opening they state that simple implementations are great and even lists some. Then the rest of the article dives specifically into online password managers, which are something else.

Browser-based password management serves the purpose of locking users into a specific browser; I'd much rather have the freedom to switch browsers at will without the cognitive tax of securely moving all my creds every time I want to switch my main browser.

That appears to be storage at rest (on disk), rather than in memory.

You're correct, thank you. Sadly I can't edit my comment anymore. Sorry for the confusion.

> Did they ever fix PCIe over thunderbolt security?

It seems to depend on whether you're on a desktop or mobile device. [1]

> macOS 13 Ventura was released in 2022 and for portable Macs with Apple CPUs Apple introduced a feature known as ‘Accessory Security’ (also known as ‘Restricted Mode’)

> By default, portable Macs (i.e. laptops) with an Apple CPU running macOS 13 Ventura or newer version of macOS will require the end user to authenticate and approve a Thunderbolt device when initially connected.

> Stationary Macs (i.e. desktops) with an Apple CPU running macOS 13 Ventura or newer version of macOS do NOT implement the ‘Accessory Security’ feature. As a result, Thunderbolt devices will be automatically approved and authenticated when initially connected.

Anecdotally, I have had Dell and Lenovo laptops with Thunderbolt and in Linux I had to manually approve each new device before it would function. [2]

[1] https://kb.plugable.com/docking-stations-and-video/do-i-need...

[2] https://wiki.archlinux.org/title/Thunderbolt#User_device_aut...

I still found it insane to display passwords that easily. Sometimes I give brief access to my PC to friends, family, acquaintances, or even colleagues, and they shouldn't be able to see my passwords with a simple button. It's like leaving your bike out unlocked, because someone with the right tools can break the locks anyway.

Chrome added app bound encryption of cookie files in 2024.

Tbf the point of the post is the "even when unused" part. A memory store is still a store.

They have what I think is the best implementation of vertical tabs, chrome doesn't even have them, firefox is so far behind it's not even funny anymore... brave's is terrible.

Many of them also have vested interests in furthering corporate authoritarianism, which is why letting users have full control over their devices is considered a security risk to them.

Come on, they could still get a blood sample to really verify that its the user

Reading arbitrary process memory can be done as a standard user. No admin needed. Any Win32 program can do it. You just can't access the memory from processes that are admin-level.

This is not true. The canonical way to prevent access is via PAGE_NOACCESS[1]. Obviously, running as admin or in kernel mode breaks the whole thing since you can re-call `VirtualProtect` on that page and open it up.

[1] https://learn.microsoft.com/en-us/windows/win32/memory/memor...

You say this as if accessing that file was any easier than accessing memory.

If I have a disk image or access to the physical drive, it's trivial. This means they can no longer be considered encrypted at rest.

It is when the computer is off.

The headline here says "stores in memory", which sounds pretty much identical to me. Can you elaborate on what you consider the difference between "loading" and "storing" into memory?

Linux stores plenty of passwords in clear text in /etc and $HOME and this is considered acceptable by most users. These same people also believe the TPM is a spy chip.

Yeah it's been years but I remember seeing arguments with Google devs saying if someone had access to your local file system, you're already SOL.

> I doubt this is an Edge-specific issue.

>> Microsoft has no interest in making their browser less secure than its upstream.

> If i leave a post-it note of my logins on my monitor, that's definitely less safe than in a unlocked drawer, and so on.

If I leave a post-it note of passwords on my monitor inside a vault to which only I have access, it’s not a big deal. That’s the point of the “airtight hatch” metaphor.

Yeah because Meltdown and Spectre [0] weren't a thing.

[0] https://spectreattack.com/

I think the catch is whether the passwords are unencrypted in memory constantly, or only during a short period when the password is being used?

Bitwarden is cloud bases keepass is local

It's a program with a file database.

No fancy browser plugins, the ability to autotype, the db file could be synced with anything you can sync files.

Working search - not sure about BW, but it's opensource implementation (Vaultwarden nowadays?) simply didn't allow to search for the fields you didn't scroll yet to.

The biggest problem is lack of multi-edit functionality - you need keep it in mind if you leave somehwere a copy running 24/7.

Nb. The above refers to KeePassX. No idea what the KeePass without the x is about. Naming things. So hard.

When someone says passwords are ‘stored’, the assumption will always be ‘stored on disk’. ‘stores in memory’ is not an accurate representation because memory is inherently volatile and they are loaded there temporarily. Plaintext on disk is egregious, plaintext in memory is considerably less so.

You really need to upgrade to UNIX Version 6 or later. Some of the improvements since 1974 are well worth having.

Really in /etc plain text? I could see some random app possibly doing that somewhere in ~/.config, but I don't think Linux itself stores passwords in plain text for systemwide use.

You know `/etc/passwd` doesn't really have passwords in it.

I thought Linux stored plain text credentials owned by root that require elevated permissions.

> Linux stores plenty of passwords in plain text in /etc

That's gonna be a big ol' [CITATION NEEDED] from me, dawg.

I've always hated that argument. Yes, if someone as access to your local file system, you are already SOL, but if that machine is part of an org, they aren't necessarily SOL except for now those plain text passwords can potentially be used for easier lateral movement to hit other, more privileged accounts (if you had access/had them saved in that password manager). At minimum, those credentials can now be used to phish the rest of your organization.

Stopping the spread is just as important as protecting any individual machine.

I think the point is that you can have arbitrary website read the browser’s memory so example.com can read the password for example.org and example.net.

That's why I disable JS by default with UBlock Origin. And OFC never allow JS to acces your clipbaord.

Cookies, if done correctly, will store a string that the server offered after a successful authentication - that string should have nothing to do with the password (it might contain some user information for logging/cross site tracking) but nothing sensitive.

With said cookie you can absolutely impersonate a user for while (potentially needing to evade user agent string checks and the like but often not)... but it will expire and then your access should be ended. If the site is well designed actions like password changing should also re-require the user's password instead of allowing anyone with just the cookie from proceeding with the action.

If it is done right cookies are pretty decently secure at keeping your secrets safe but, for convenience they do lower the security that could be accomplished with more involved techniques.

As an aside Oauth's key -> token approach is basically identical to password -> cookie (assuming best practices are in place).

Or unless you need to reenter password/offer fingerprint after certain amount of time. Which, I think, should be the actual standard, and typically is with the apps like Bitwarden.

Look, Ihate Microsoft too but Edge is just Chrome with a different skin, so they'd have to have gone out of their way (and spent money paying engineers) to make Edge less secure than Chrome/ium.

Wouldn’t a guard page be readable in Linux with /proc/self/mem ? (at least read only pages are writable with it)

> It's a very standard defense-in-depth technique

Is there any software we’d be aware of which uses this technique

> Having passwords on post-it notes does make certain types of attacks much easier.

It also makes other attacks much harder. Namely I don't need to worry about some zero-day in my password manager.

I think we've moved away from the secure perimeter thinking and towards defense in depth - if that list of passwords helps you get somewhere other than the vault, removing the post-it improves security. Vaults get infiltrated all the time - and often in partial ways like being able to see into the vault but not reach in.

Right; but in the scenario of this Tweek, you've invited someone untrustworthy into the vault and are then freaking out because they can see the post-it note of passwords. It is inherently irrational.

This issue is inherently unfixable by ANY password manager, because the process model of the underlying OS isn't itself secure. No obfuscation will work, because the password manager itself needs to de-obfuscation it before use (and that memory too is dump-able).

All adding in-memory obfuscation does it make ignorant people feel better, while not moving the security needle even an inch.

At least with Keepass it's locked in an encrypted store and only available exactly when I need it to be. I can take other precautions if I want when I want to access it.

With your browser's password manager you're stuck with the slop you were given.

So are you typing your password every single time you want to unlock that store? If not, where's the master password stored? I know Keychain does something advanced with the enclave.

> Credential Guard prevents credential theft attacks by protecting NTLM password hashes, Kerberos Ticket Granting Tickets (TGTs), and credentials stored by applications as domain credentials.

> Credential Guard uses Virtualization-based security (VBS) to isolate secrets so that only privileged system software can access them.

https://learn.microsoft.com/en-us/windows/security/identity-...

Windows 11* and MacOS also do the job as long as you're using hardware bound passkeys.

Bitwarden has taken investor money, sadly. It's still in good shape for the moment. But the time will come when they place profits above other needs; it's a matter of when, not if.

This makes me miss running Qubes a few years ago, and keeping BitWarden in a separate VM from everything else. I've never felt as secure as when I had that setup.

This only works if credential guard has implemented a way to build a subsequent token/value from that secret. For things like basic auth the secret would need to eventually hit the userland process that needs it in some shape or form to then embed it in the HTTP payload which is plaintext.

I was looking for an answer to this when it comes to using Edge password manager in particular, it uses Windows Hello as far as I know and while it does make 'synced' passkeys they don't seem to be usable anywhere than the original machine. Useful when reinstalling Windows at least.

https://yourpasskeyisweak.com does not mention Edge.

Luckily offering enterprise / credential sharing features is a decent freemium model. It still wins out in keeping compatibility with self hosted vaultwarden, are there other extensions that let you point to your own domain for the encrypted blob storage?

The way to think about security is as a system of layers, each of which filters out ever more sophisticated attackers.

We should care about all kinds of attackers, and not assume that the protections against the most sophisticated will obviate the protections against the least sophisticated.

The Swiss cheese model. Each single layer has holes, but when stacked the combined hole area is minimized https://en.wikipedia.org/wiki/Swiss_cheese_model

Okay. Can you describe an attack / threat model where it would matter in this particular case?

isn't it at risk of any code pathway that somehow allows you exceed a buffer and read memory unbounded? Then a nefarious web page could capture that? That's a huge exposure surface.