Re:Google to strip Chrome of standard SSL revocation checking
by magicalist on Tuesday February 07, 2012 @03:14AM
(#3560957)
er, that sounds exactly what you would expect from a security researcher :)
More seriously, these are certainly not hypothetical attacks (the DigiNotar thing was just a few months ago), and the fact that that "1%" can figure out how to see your passwords just by googling "master password firefox" shows exactly why this isn't a security issue (in some strict sense).
You could certainly make it slightly harder to see them than clicking a few buttons (with the same reasoning you put a confirmation dialog before someone deletes their life's work), but there are good arguments on both sides about the utility of that kind of security theater.
This doesn't work for everyone, but I personally set up a guest account on my computer and enable fast user switching. I can worry a lot less about multiple aspects of my 5 year old cousin using my computer, then.
More seriously, these are certainly not hypothetical attacks (the DigiNotar thing was just a few months ago), and the fact that that "1%" can figure out how to see your passwords just by googling "master password firefox" shows exactly why this isn't a security issue (in some strict sense).
You could certainly make it slightly harder to see them than clicking a few buttons (with the same reasoning you put a confirmation dialog before someone deletes their life's work), but there are good arguments on both sides about the utility of that kind of security theater.
This doesn't work for everyone, but I personally set up a guest account on my computer and enable fast user switching. I can worry a lot less about multiple aspects of my 5 year old cousin using my computer, then.