Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

Chrome Security Shocker Creates Password Anxiety

Google responds to criticism of stored password handling; security experts say Chrome security team is missing the forest for the trees.

9 Android Apps To Improve Security, Privacy
9 Android Apps To Improve Security, Privacy
(click image for larger view)
Should people be able to instantly retrieve -- in plaintext -- all the saved passwords stored by the browser they're using?

That's the information security question of the week after Elliott Kember, a director at software development firm Riot, called out Chrome's insane password security strategy. "Google isn't clear about its password security," he said in a blog post, in which he accused Chrome of not behaving as ordinary users would expect. Specifically, after Chrome gets its hands on a password, the browser will reveal it with a single click.

Kember acknowledged that technically astute types often recommend that people avoid storing their passwords in the browser, and use a third-party password manager instead. Another common argument, he said, is that "the computer is already insecure as soon as you have physical access."

But would the average user -- who may share their computer with family or friends -- expect that anyone with access to their PC might so easily retrieve all stored passwords in a single go? "Go up to somebody non-technical. Ask to borrow their computer. Visit chrome://settings/passwords and click 'show' on a few of the rows. See what they have to say," said Kember. "I bet you it won't be 'That's how password management works.'"

[ Department of Homeland Security urges all website operators to check for vulnerability. Read HTTPS Hackable In 30 Seconds: DHS Alert. ]

Google's Chrome team, however, sees things differently. "I appreciate how this appears to a novice, but we've literally spent years evaluating it and have quite a bit of data to inform our position," posted Justin Schuh, head of Chrome security, to the Hacker News site. "And while you're certainly well intentioned, what you're proposing is that that we make users less safe than they are today by providing them [with] a false sense of security and encouraging dangerous behavior. That's just not how we approach security on Chrome."

Schuh added that passwords stored by any application on a system are "trivially recoverable" by anyone with access to that system, and said adding a master password to the application was "security theater."

Many security experts, however, said that Schuh missed the forest for the trees.

"How to get all your big sister's passwords ... and a disappointing reply from Chrome team," tweeted World Wide Web inventor Tim Berners-Lee.

How do other browsers handle passwords? Apple's Safari includes a "show password" setting, but to be enabled, OS X first requires the user to enter their master keychain password. In fact, Kember's post was sparked by his finding that when importing bookmarks on his Mac from Safari to Chrome, all of the passwords stored by Safari had to be automatically loaded into Chrome, at which point anyone with access to his Mac could reveal them with a single click -- no password required.

Like Chrome, both Firefox and Opera will show passwords, although they do allow users to restrict access to that feature by adding a master password. Still, per Schuh's comment, anyone with the requisite skills can still retrieve the stored passwords. The same applies for passwords stored by Internet Explorer, which can be retrieved via Registry tweaks or by using free third-party tools.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Sodinokibi Ransomware: Where Attackers' Money Goes
Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
Data Privacy Protections for the Most Vulnerable -- Children
Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
7 SMB Security Tips That Will Keep Your Company Safe
Steve Zurier, Contributing Writer,  10/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: The old using of sock puppets for Shoulder Surfing technique. 
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-17513
PUBLISHED: 2019-10-18
An issue was discovered in Ratpack before 1.7.5. Due to a misuse of the Netty library class DefaultHttpHeaders, there is no validation that headers lack HTTP control characters. Thus, if untrusted data is used to construct HTTP headers with Ratpack, HTTP Response Splitting can occur.
CVE-2019-8216
PUBLISHED: 2019-10-17
Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure .
CVE-2019-8217
PUBLISHED: 2019-10-17
Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-8218
PUBLISHED: 2019-10-17
Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure .
CVE-2019-8219
PUBLISHED: 2019-10-17
Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .