News for hackers. Stuff that matters.
Re:Please turn on two-factor authentication by robomartin on Tuesday August 07, 2012 @02:40PM (#4351546)
All this talk about security and multiple authentication levels yet, your browser --if you use Chrome-- is the worst security leak in a persons digital life. It would take almost anyone a minute in front of a computer to fire-up Chrome and have every single login and password available in plain text.

I've written about this before and so have countless of other techies. A non-techie has not a single clue, making them perfect victims. Any number of scenarios can be imagined: From taking your laptop in for repairs/upgrades to someone gaining physical access to your machine for just a few minutes. And, just like that, your digital life is turned upside-down.

Re:Please turn on two-factor authentication by danweber on Tuesday August 07, 2012 @04:58PM (#4352263)
I think most people are aware that the passwords saved in their browser are, well, saved in their browser, and if someone unkind gains access to the browser they gain access to all the sites with saved passwords.
Re:Please turn on two-factor authentication by robomartin on Wednesday August 08, 2012 @01:25PM (#4356782)
The point is that Chrome doesn't even make an attempt to slow down potential thieves. And, while I understand that absolute security is impossible, Chrome makes it so even a technology neophyte can steal your digital life with a few minutes of low-effort point-and-click action.

I use Chrome all the time. As a developer I am keenly aware of the issues and manage the risk. I will not allow anyone in my family to use Chrome because the potential security leak could have dire consequences.

Re:Please turn on two-factor authentication by lee on Tuesday August 07, 2012 @04:45PM (#4352195)
Curious, could you point to a blog post or article that explains how to do this?
Re:Please turn on two-factor authentication by robomartin on Wednesday August 08, 2012 @01:20PM (#4356753)
Here's what a thief could do:

Open Chrome

Go to Settings

Click on "Show Advanced Settings"

Click on "Managed Saved Passwords"

Click on a saved password

Click on "Show"

Write down or copy/paste/email the login in this fashion one-by-one.

If they are after a pile of logins, keep clicking "Show" all the way down the list. Capture the screen and email/print or simply take your smartphone and snap a picture.

Scroll through the entire login list to get it all.

Takes very little time to get all of someone's private login data in this fashion. An, since the vast majority of Internet users re-use login user id's and passwords across many services I would imagine it might not take long to identify this pattern and have access to every login.

Locking the workstation behind a password doesn't help either for a number of reasons, not the least of which is that workstation password removal, recovery or cracking tools are widely and easily available.