News for hackers. Stuff that matters.

A comment on Microsoft Edge stores all passwords in memory in clear text, even when unused. Parent comment

Re:Microsoft Edge stores all passwords in memory in clear te... by jurf on Tuesday May 05, 2026 @02:03AM (#48018642)
Yeah because Meltdown and Spectre [0] weren't a thing.

[0] https://spectreattack.com/

[ Parent | on HN ]
Re:Microsoft Edge stores all passwords in memory in clear te... by hWuxH on Tuesday May 05, 2026 @06:19PM (#48029507)
If passwords are fetched remotely on-demand, you steal the account API key from memory. If they're encrypted, you steal the master password or decryption key. ... So what's your solution?
[ Parent | on HN ]
Re:Microsoft Edge stores all passwords in memory in clear te... by jurf on Monday May 11, 2026 @06:28AM (#48093180)
I think it’s more about layers of defense being always better than relying on a single point of failure.

IIRC those bugs could only steal data, not do remote execution. If you did not store even the encrypted passwords in memory, getting the password/key to them compromised would still keep you safe, or at least upgrade it to a timing attack.

[ Parent | on HN ]