News for hackers. Stuff that matters.

A comment on Microsoft Edge stores all passwords in memory in clear text, even when unused. Parent comment

Re:Microsoft Edge stores all passwords in memory in clear te... by Dwedit on Monday May 04, 2026 @05:43PM (#48015426)
Guard pages are one-shot exceptions used for growing the stack.
[ Parent | on HN ]
Re:Microsoft Edge stores all passwords in memory in clear te... by dvt on Monday May 04, 2026 @07:21PM (#48016237)
They also act as access alarms[1]. Why even comment if you didn't bother to read the docs?

> The PAGE_GUARD protection modifier establishes guard pages. Guard pages act as one-shot access alarms. For more information, see Creating Guard Pages.

[1] https://learn.microsoft.com/en-us/windows/win32/api/memoryap...

[ Parent | on HN ]
Re:Microsoft Edge stores all passwords in memory in clear te... by Dwedit on Monday May 04, 2026 @09:48PM (#48017150)
Guard pages are for the process that creates them, they're not for the other processes that try to read the memory.
[ Parent | on HN ]
Re:Microsoft Edge stores all passwords in memory in clear te... by dvt on Tuesday May 05, 2026 @01:08AM (#48018291)
Absolutely wrong. Are we writing the same code here? Page guards are for all userspace access. (In fact, I think kernel space might also trigger them, but can be circumvented. PS: I'm being polite :) Kernel space 100% triggers them, but can be cleverly circumvented by fucking with logs.)
[ Parent | on HN ]
Re:Microsoft Edge stores all passwords in memory in clear te... by Hikikomori on Tuesday May 05, 2026 @04:10AM (#48019419)
Could you not use VirtualProtectEx to strip PAGE_GUARD?

Even so, none if these methods offer protection, at best you can get some detection, but that doesn't matter when they got your passwords already.

[ Parent | on HN ]