ISSUE 18.26 • 2021-07-12 PUBLIC DEFENDER By Brian Livingston When some readers installed the new Microsoft Edge browser — which replaces the old “lega
[See the full post at: Microsoft Edge imports other browsers’ passwords]
|
Patch reliability is unclear. Unless you have an immediate, pressing need to install a specific patch, don't do it. |
-
Microsoft Edge imports other browsers’ passwords
- This topic has 50 replies, 17 voices, and was last updated 2 years, 2 months ago.
AuthorViewing 18 reply threadsAuthor-
Both New Edge and Google Chrome are based on Google’s Chromium browser engine. They share a lot of code and features. Probably this behavior we are discussing is a result of the shared features, not some imaginary Google-Microsoft hegemony.
The Chromium browser engine is open source, and is trusted by the Linux developer community. That’s not what would happen if this alleged hegemony were real.
-- rc primak
1 user thanked author for this post.
-
This is what you get with google account too. You sync yor passwords through all your devices. This should be handled carefully and be aware, where you log to your account 🙂 This is meant to be that way.
Dell Latitude 3420, Intel Core i7 @ 2.8 GHz, 16GB RAM, W10 22H2 Enterprise
HAL3000, AMD Athlon 200GE @ 3,4 GHz, 8GB RAM, Fedora 29
PRUSA i3 MK3S+
1 user thanked author for this post.
-
We cannot always blame opportunists for stealing cars when the driver leaves the car running and doors unlocked while getting coffee at the local quickee mart.
So accusing Edge of this and that, per se, when it comes to aggregating information from FireFox is not the issue.
The issue at hand is FireFox for having allowed the door to be opened to begin with and this permitted other browsers to violate our privacy.
In this case cited by this article, our logins and passwords were covertly aggregated from FireFox. But are we not led to believe that the sole purpose of FireFox’s existence is to protect our privacy? If its not, then why not use the other browsers? Based on a number of posts by unhappy FireFox consumers that have experienced the new versions of FireFox as proverbial train-wrecks and demand to rollback to a functional version of FireFox or they will switch browsers; they are told in so-many words “You can take it or leave it for the other browsers”
I suppose the subsequent question is, what else had been / is being ascertained by other methodologies while using FireFox? I would bet there is a lot more than what we think.
Imo, this is one example where Mozilla is talking the talk, but not doing the walk.
1 user thanked author for this post.
-
-
Firefox has a master password option, and with that set, it would not be possible to have the passwords imported automatically. When a master password is used, the password store on the disk is encrypted using a salted, hashed version of the master password. Without a master password, the passwords are easily readable by any process on the same user account.
It is no secret that having a no master password setup leaves it wide open… this is not something that Mozilla can change, other than forcing people to use a master password (and thankfully they do not do that). The more secure option is yours to use, but it is not anyone’s job to try to force you to use it.
Any other browser without a master password would be the same, and I am not sure if this is still the case, but a while ago Google was very adamant in their refusal to implement a master password in Chrome. People had been asking for one like Firefox has, but Google essentially told them to stop asking, because they had already said ‘no,’ and they were tiring of having to say it again.
Firefox’s business model has nothing to do with trafficking in user data, and it only syncs if you log in with a Firefox account (which is totally optional) and tell it to begin syncing things. If you don’t like that, don’t create an account, or just don’t log in with it. It’s there if you want to use it, but it won’t happen without you knowing.
I have a lot of issues with the way Mozilla has been behaving for the past decade plus, but that’s not one of them.
Dell XPS 13/9310, i5-1135G7/16GB, KDE Neon
XPG Xenia 15, i7-9750H/16GB & GTX1660ti, KDE Neon
Acer Swift Go 14, i5-1335U/16GB, KDE Neon (and Win 11 for maintenance)5 users thanked author for this post.
-
-
-
Firefox encrypts the password store on the disk if the master password is set, so it could not be read by any process that did not have the encryption key (which is derived from the master password). Without the master password, the password store is in plain text, since there would be nothing from which to derive the encryption key.
“Serious” password managers that Brian Livingston recommends differ from most browser password saving features by virtue of requiring a master password. They’re always encrypted, and like Firefox with a master password, have settings where you can tell them how long to leave the password store unlocked after you enter the master password.
Even with the store unlocked, the file on disk containing the password is unreadable without the encryption key, which other processes will not have. Malware could attempt to hijack the browser or password program that knows the master password, or to use some kind of exploit to try to read the encryption key directly from RAM allocated to the browser, or to use a keylogger to grab the password as it is entered into the password manager, but these are harder to accomplish than simply reading a plaintext file stored in a known location on the hard drive or SSD.
Firefox does have a “Lockwise” password app for Android that works independently of Firefox, and from within Firefox, if you set the master password, it should be equivalent to a “serious” password manager as far as protecting the contents from potential malware.
That said, I like Bitwarden. It has extensions for Chrome and Firefox, and there is a version of the Android app that has no telemetry (the version on F-Droid).
Dell XPS 13/9310, i5-1135G7/16GB, KDE Neon
XPG Xenia 15, i7-9750H/16GB & GTX1660ti, KDE Neon
Acer Swift Go 14, i5-1335U/16GB, KDE Neon (and Win 11 for maintenance)2 users thanked author for this post.
-
-
-
-
Bottom line is that Mozilla promotes it’s product as a superior app for protecting our privacy. But clearly, it was disproven by the author of this article.
That is incorrect. What you are describing is a security issue, not a privacy issue. They’re not the same thing. Firefox is superior to Chrome in privacy, and unless Google changed their edict about Chrome not having a master password, it’s superior in security on this one issue too.
Rhetorically speaking / asking: Why was our privacy not protected from the other apps installed on the machine by Mozilla?
Privacy protection on a browser is about keeping your info from being slurped by web sites. Other programs the PC user has chosen to run are not under that umbrella.
Mozilla gives you the means to protect yourself with the options built into Firefox, unlike pretty much all the other browsers out there (excluding Mac– I have no idea whether or not Safari has that feature). They’re not going to force you to use the security features if you don’t want to. It’s not their job to force people to protect themselves or to make sure that everyone is doing things the way the security experts would have them do. It’s up to the user to make use of the tools provided in the manner he sees fit, and to bear the responsibility of those choices.
If the other apps installed on the machine are not trustworthy, they are malware, and you should get rid of them. They can cause all sorts of problems for you even if you had the master password set in Firefox. That’s why it is important not to run just any old program from anywhere out there on the web… if it is programmed to do nasty things, letting in past the perimeter is going to be trouble.
What Edge did is presumptuous and in poor form, but it didn’t take people’s passwords and send them to hackers somewhere. The blame is on Microsoft for doing what it did without permission, not on Mozilla for not forcing people to protect themselves (which comes with a certain level of inconvenience and annoyance).
Why did Mozilla turn a blind eye at the back door in its browser?
There isn’t one (as far as anyone knows), and they didn’t. They’ve been the only browser in town that gives users the means to protect their passwords for years. If people chose not to, it’s on them, not Mozilla. Firefox is quite literally the best in class for this very thing you’re criticizing it for. None do it better, most do it worse.
And how exactly is Mozilla using our personal information to further their undisclosed agenda and the marketing of their browser ?
They use the information to see what features are used and which are not, but the information is not used to personalize ads or for any other purpose that requires a persistent ID. They don’t sell ads, and they don’t collect or sell personal data. There’s big money in that stuff, and they wouldn’t be dependent on the biggest villain on the internet (Google) if they had their own significant source of money.
And where is the revenue coming from (and used) for the operations of the Mozilla For-Profit entity?
I believe all of this information is a matter of public record.
The “for-profit” bit of Mozilla is a tax classification. There are things that non-profits cannot do under US law (where Mozilla is incorporated), and to do these things without running afoul of tax law, they must have a for-profit bit. Not that there’s anything at all wrong with profit, of course. I wish Mozilla made more profit on its own so it wouldn’t have to be dependent on Google.
Therefore, the principles are not invoked. And its open-source browser is little by little being privatized.
The development of Chromium is completely controlled by Google. The only concern Google has for the development of Chromium is how it benefits Google’s downstream product, Chrome. Things that don’t benefit Google don’t make it into Chromium. It is not developed by or for “the community.” It’s developed by paid Google developers for the purpose of making Google money. Even so, it’s still open source, fully and completely, and because of that, it forms the basis of browsers like Brave, which are all about being private. That’s what “free open source software” means. It means you can take the code, read it, modify it, and use it as you see fit. It has nothing to do with it being developed as some part of a public service.
Firefox is licensed under GNU, so it is impossible for it to become closed source. Anyone can modify the code as they see fit, but the GNU license requires that all such modifications be released under GNU licensing also.
Chromium has component bits that are licensed differently, but the majority of it is Apache/MIT licensing, so it would be within the terms of the license for someone to take that code and make a derivative product and not make the code for the derivative product available. That was how Apple used a MIT-licensed flavor of UNIX to create the closed-source OSX. The MIT license is more free than GNU, but that means any derivative product could be made closed source. Firefox’s license does not permit that. It can’t be made closed source, and no product that uses Firefox code can be made closed source.
That influx of corporate cash has kept Mozilla alive, and has brought great benefit to the Linux world. There is a great deal of corporate money pouring into Linux, and I am really glad it is, because it’s made Linux far better than it would be otherwise. Linux, like Mozilla, is licensed under the GPL, so any product that is developed from it must also be open source, no matter how much for-profit corporate money is invested in its development.
Dell XPS 13/9310, i5-1135G7/16GB, KDE Neon
XPG Xenia 15, i7-9750H/16GB & GTX1660ti, KDE Neon
Acer Swift Go 14, i5-1335U/16GB, KDE Neon (and Win 11 for maintenance) -
-
It is, or at least should be, considered very bad form to do something like this without asking the user for permission *first*.
That being said, we are talking about a vendor that does whatever it wants to do and then either tells us that it was for our own good, or that they’re sorry and won’t do it again, until the next time they need to elevate one of their products over competitors in the market via shady tactics. Never facing any meaningful consequences for crossing lines of acceptable behavior is also another aspect in their favor.
1 user thanked author for this post.
-
-
If you don’t trust the browser, not storing anything within it won’t help you much, as it could be doing all of that on its own, without telling you.
Dell XPS 13/9310, i5-1135G7/16GB, KDE Neon
XPG Xenia 15, i7-9750H/16GB & GTX1660ti, KDE Neon
Acer Swift Go 14, i5-1335U/16GB, KDE Neon (and Win 11 for maintenance)2 users thanked author for this post.
-
The security group also lists numerous exploits that hack into the old Windows Credential Manager and even some password managers, such as KeePass.
… also including credential files for your real, serious password manager top-choice recommendation, 1password?
Windows 11 Pro version 22H2 build 22621.2359 + Microsoft 365 + Edge
1 user thanked author for this post.
-
See the original report from ISE:
However, we found that in all password managers we examined, trivial secrets extraction was possible from a locked password manager, including the master password in some cases, exposing up to 60 million users that use the password managers in this study to secrets retrieval from an assumed secure locked state.
https://www.ise.io/casestudies/password-manager-hacking/index.html
This was in 2019. All the major Password Managers have taken steps since that time to mitigate the memory persistence issue. None that I know of has as yet completely eliminated the possibility of an attacker with local access to the computer, extracting persistent data including unencrypted passwords from RAM. Even with the Password Manager in a closed and locked state.
Memory protection is an ongoing problem in computer security. No Password Manager, not even a paid one, has a “lock” on overcoming this class of threats.
I do question whether there’s some hidden financial motive in knocking an open source password manager and recommending a commercial product?
-- rc primak
I’d recommend not to allow passwords to be saved or stored in an internet facing program. Keepass and others are far better dedicated programs for this with encryption. Browsers are trying to be everything these days, which is not good for security no matter what anyone claims. It’s at your own risk to trust them.
-
Its hard to decide today. There are tens, hundreds of sites and software, that require passwords. If you coose to store the password somewhere, its obvious, that its less safe.
Really sad fact is, that we are even often forced to periodically change those passwords, thats why I understand, that someone chooses some password manager.
But this security issue is also part of the operating system – we all know those silly proclamations like “Wellcome to the world of Windows 10, the safest and greatest system ever, bla bla..” Then their official browser literally steals your passwords from another browser. This is not easy discussion.
Dell Latitude 3420, Intel Core i7 @ 2.8 GHz, 16GB RAM, W10 22H2 Enterprise
HAL3000, AMD Athlon 200GE @ 3,4 GHz, 8GB RAM, Fedora 29
PRUSA i3 MK3S+
1 user thanked author for this post.
-
-
Hopefully the developer of the Password Manager does the extra coding to clear memory of secrets to the maximum extent possible. I wonder if TPM 2.0 has support to solve this RAM scraping problem.
It doesn’t. The TPM is a secure storage place for things like encryption keys (that could be used to secure a password store), but the system has to pull the key out of the TPM and place it in memory in order to use it. Once it’s in RAM, it is vulnerable to any malware that might seek to read such things right from memory.
That’s not to say that it is simple for a malware process to just start going through the memory and look for anything interesting. There are a bunch of protections in place to prevent this kind of thing, but it’s a broad attack surface, and exploits are always possible. It’s also possible that side channel exploits (like Spectre) can be used to bypass the protection mechanisms that prevent an arbitrary process from sifting through the RAM (that has not been allocated to that process) and looking for something to steal.
This whole thing is something of a tempest in a teapot, though. If you don’t have to enter a password to access any kind of sensitive information, of course it is vulnerable to being read by other processes, even if it is on an encrypted volume (which protects against offline attacks, but once it’s unlocked, as it is while the system is in use, it’s vulnerable).
This isn’t unique to browsers or password managers, and it’s why you don’t want malware running on the system at all (rather than thinking it is possible to lock everything down enough to prevent malware from being able to do any harm at all). Invariably, the more locked down the system is against these kinds of threats, the more that legitimate uses are blocked or made much less convenient.
The bit about Edge importing things without being asked is about the audacity of MS in just having it do that. It’s not remarkable, surprising, or scandalous in any way that it was able to import passwords from an unsecured password store. This is the expected situation, and it’s why Mozilla gives you the option of using a master password.
Dell XPS 13/9310, i5-1135G7/16GB, KDE Neon
XPG Xenia 15, i7-9750H/16GB & GTX1660ti, KDE Neon
Acer Swift Go 14, i5-1335U/16GB, KDE Neon (and Win 11 for maintenance)
-
-
-
Well, you can’t lose a biometric, can you?
Yes. A fingerprint can become useless if there is a cut on the pertinent part of the finger, for example, or (heaven forbid) the finger is lost somehow. And if the biometric data or their analog precursors, like an actual fingerprint on an object, are harvested by an attacker who has a method of turning them into a useful exploit (like the one where security researchers were able to use gummy bears to fool a fingerprint sensor), you can’t just change your fingerprint the way you could change a password.
Biometrics are best used as a security enhancement to an existing conventional (password and user ID) login, not instead of one. Many of the things that make password managers vulnerable apply to biometrics too. The encryption key in RAM is no less vulnerable on a system with biometrics than one without, or from one that uses two factor authentication.
I would not want passwords to go away. The replacements have invariably been less secure and with greater attack surface. These replacements are not necessarily meant to be more secure (though they would be if they were used with a password and not instead of one), but rather more convenient, which can have the effect of increasing security if the inconvenience of the old method caused the user to not have a password or to use one like ‘123456’ or ‘password’.
It’s something of a paradox that security can sometimes be increased by decreasing security, or its inverse: Sometimes making something a little bit more secure (and a little less convenient) results in less security, as people quit using the security feature that has become too much of a pain in the rump for them to tolerate.
This is a personal choice that every person has to make. How much inconvenience are you willing to tolerate for the purpose of security?
Dell XPS 13/9310, i5-1135G7/16GB, KDE Neon
XPG Xenia 15, i7-9750H/16GB & GTX1660ti, KDE Neon
Acer Swift Go 14, i5-1335U/16GB, KDE Neon (and Win 11 for maintenance)3 users thanked author for this post.
-
I thought it was from Windows but could not find how to turn it off as I never save passwords in some unknown place in my PC.
It depends, what bowser you are using.
Native Windows browsers (eg Internet Explorer or Edge) do store your passwords in the Old Control panels >> Credential manager. Thats the unknown place, where your stored passwords can be seen, modified or deleted.
Firefox or chrome do use their own storage inside the program itself.Dell Latitude 3420, Intel Core i7 @ 2.8 GHz, 16GB RAM, W10 22H2 Enterprise
HAL3000, AMD Athlon 200GE @ 3,4 GHz, 8GB RAM, Fedora 29
PRUSA i3 MK3S+
4 users thanked author for this post.
-
Native Windows browsers (eg Internet Explorer or Edge) do store your passwords in the Old Control panels >> Credential manager.
Legacy Edge only. Is anyone still using that?
Windows 11 Pro version 22H2 build 22621.2359 + Microsoft 365 + Edge
1 user thanked author for this post.
-
-
Viewing 18 reply threads
Plus Membership
Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.
AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments.
Get Plus!
Recent Topics
-
Microsoft’s massive Windows 11 update, featuring Copilot AI, begins rolling out
by 27 minutes ago
-
Microsoft’s massive Windows 11 update, featuring Copilot AI, begins rolling out
by 28 minutes ago
-
MailStore Home updates
by 12 hours, 54 minutes ago
-
T-Mobile users say they see other people’s account information
by 1 day ago
-
Retirement of Exchange Web Services in Exchange Online
by 1 day, 12 hours ago
-
What Remote Desktop credentials do I use to access a MS Account computer
by 1 hour, 38 minutes ago
-
Office 2003 Compatibility with One Drive in Windows 11
by 1 day, 23 hours ago
-
Has KB5030219 been pulled for Windows 11 Pro for Workstations?
by 1 hour, 53 minutes ago
-
By default encryption on Apple
by 1 day, 16 hours ago
-
KB5029331 Macrium/Reflect
by 1 day, 18 hours ago
-
Windows 10 Build 19045.3513 (22H2) to Release Preview Channel
by 2 days, 5 hours ago
-
Microsoft worker accidentally exposes 38TB of sensitive data in GitHub blunder
by 1 day, 14 hours ago
-
Change CPU/Mainboard without reinstallation of OS and Apps – Win10
by 1 day, 19 hours ago
-
Mouse slows to crawl if Edge in focus
by 3 days ago
-
Windows and Surface chief Panos Panay is leaving Microsoft
by 2 days, 14 hours ago
-
Essential Office Portable
by 3 days, 2 hours ago
-
Essential Office: Disable Spell Check
by 3 days, 2 hours ago
-
Apple 2030
by 1 day ago
-
Wi-Fi 7? Why not!
by 7 minutes ago
-
Second city — the AI view from Washington
by 3 days, 11 hours ago
-
Zeroing in on zero days
by 1 day, 20 hours ago
-
LMDE – Software Update
by 1 day, 1 hour ago
-
MacAfee anti virus left overs
by 20 hours, 24 minutes ago
-
Google issues update for Chrome 109 (Win 7 – Server 2012r2) that fixes WebP
by 1 hour, 10 minutes ago
-
Microsoft apparently canning P2P Win32 services on Windows 11 23H2, Windows 12
by 3 days, 20 hours ago
-
Inserting from clipboard into posting
by 3 days, 20 hours ago
-
Background picture not invoked @ startup
by 1 day, 23 hours ago
-
download Linux Mint most recent
by 4 days, 4 hours ago
-
Modify email account settings
by 4 days, 12 hours ago
-
Microsoft’s Edge 109 updates for Windows 7 , 8, 8.1, 2012 R2 ! webP fix
by 5 days, 1 hour ago
