How Browsers Store Your Passwords (and Why You Shouldn't Let Them)

Re:How Browsers Store Your Passwords (and Why You Shouldn't ... by UnoriginalGuy on Friday June 21, 2013 @05:07PM (#5921010)

Let's assume for the sake of argument that we are running code on both a Windows machine and an OS X machine, and trying to steal someone's browser passwords.

While it is undeniable that the OSX keychain adds a roadblock to the theft, many average users would happily enter their password if the box was displayed when they ran up their browser (even if the browser wasn't the originating process) and likely also fall for a fake keychain prompt.

I think the keychain is a good thing (just as it is in Android). Just wanted to make the point that the keychain for your average non-power user is a minor roadblock in theft, rather than a "real" security feature.

[ Parent | on HN ]

Re:How Browsers Store Your Passwords (and Why You Shouldn't ... by Corrado on Friday June 21, 2013 @09:54PM (#5922214)

Yes, but there is nothing that a program can do to prevent the user from hanging themselves. If an attacker has access to your hardware and user session then they can do almost anything, and at the OS level too.

At least Chrome extends the supplied OS security features and doesn't try to re-engineer them from scratch. This makes me more comfortable with Chrome rather than less.

[ Parent | on HN ]

Re:How Browsers Store Your Passwords (and Why You Shouldn't ... by jrochkind1 on Monday June 24, 2013 @12:44AM (#5931035)

You're mostly talking about what's basically a phishing attack, right?

I'm not really sure there is really any defense yet devised for phishing attacks against 'average non-power users.'

I'm not disputing you though, I think it is a problem. But unrelated to how securely a given app stores sensitive info, which is what OP is about.

[ Parent | on HN ]