A security researcher has discovered that Microsoft Edge will load all your stored passwords into memory in plaintext at startup, making it easy for malware to scrape those passwords.
Chrome’s handling is barely more secure. A compromised device will have a much easier time reading Chrome’s encrypted store than scanning your RAM to find passwords.
Regardless, they’re still loading them into memory in plain text, and knowing this exists, is going to be an easier task to grab than dealing with the encrypted store chromium uses. At least chromium uses the in built credential api to try to protect the secrets, the fact edge doesn’t is an egregious security hole.
I don’t disagree that users need to have to enter a password to view their stored passwords, but you’re hand waving a massive and intentional decrease in security on Edge’s part. No matter how easy it is to get out of another browser, this is a violation of basic secure development practices. Security is only as strong as the weakest link, and edge is determined to not even close one of the easiest links in the chain.
I will disagree on the RAM scanning being easier. It is my opinion that the weakest link here is the password store.
The security hole here is a password management system that can work without external secret. It is shocking that this is still common practice and that people use them.
Regardless, they’re still loading them into memory in plain text, and knowing this exists, is going to be an easier task to grab than dealing with the encrypted store chromium uses. At least chromium uses the in built credential api to try to protect the secrets, the fact edge doesn’t is an egregious security hole.
I don’t disagree that users need to have to enter a password to view their stored passwords, but you’re hand waving a massive and intentional decrease in security on Edge’s part. No matter how easy it is to get out of another browser, this is a violation of basic secure development practices. Security is only as strong as the weakest link, and edge is determined to not even close one of the easiest links in the chain.
I will disagree on the RAM scanning being easier. It is my opinion that the weakest link here is the password store.
The security hole here is a password management system that can work without external secret. It is shocking that this is still common practice and that people use them.