News, tips, advice, support for Windows, Office, PCs & more
Home icon Home icon Home icon Email icon RSS icon

We're community supported and proud of it!

AskWoody Free Newsletter Logo
ISSUE 18.26.F • 2021-07-12

In this issue

PUBLIC DEFENDER: Microsoft Edge imports other browsers’ passwords

Additional articles in the PLUS issue

LANGALIST: Yikes! Still more subscriber OneDrive problems, solutions!

HARDWARE: The Trusted Platform Module has just become important

BEST UTILITIES: Three free tools to check Windows 11 compatibility

PATCH WATCH: MS-DEFCON 2 — To patch or not to patch

Best secure VPN service
If you purchase after clicking this ad, AskWoody may receive a small commission.


PUBLIC DEFENDER

Microsoft Edge imports other browsers’ passwords

Brian Livingston

By Brian Livingston

When some readers installed the new Microsoft Edge browser — which replaces the old “legacy Edge” — they got a big surprise. They discovered that Edge had somehow magically absorbed all the usernames and passwords they’d carefully saved in their previously installed browsers, such as Chrome, Firefox, Internet Explorer, and legacy Edge.

What’s even more surprising is that Edge — which until recently couldn’t import or export passwords at all — may be doing this new behavior by design.

The bad news is that you shouldn’t store passwords in Edge in the first place — or in any browser, really. This may allow other programs, including malware, to read passwords that are stored in machine-readable files. Please read on.

Install the new Edge, and it immediately knows all your passwords?

The password-vacuuming behavior described above occurred because of the following sequence of events, according to one reader:

  • He originally used Firefox 88 as his browser and enabled it to store the usernames and passwords for several websites. But he never set a “primary password” to encrypt the file where Firefox stored his credentials.
  • He installed the new Edge. He later discovered that Edge had silently imported all his usernames and passwords that Firefox had previously stored. He says Edge never asked for his consent to copy the credentials.
  • He installed Firefox 89 some time later but didn’t allow the Mozilla browser to copy any of his stored credentials. To his surprise, when he used Firefox 89 to visit websites where he’d previously signed in, Firefox asked whether it should import the credentials from Edge’s password file.

Figure 1 shows the dialog box the reader photographed with his phone. This yes-no query might be named “May I import the passwords from Edge that you didn’t know Edge already had a copy of?”

Firefox can import passwords from Edge
Figure 1. When Edge was installed, it copied the passwords that had been stored by an existing instance of Firefox, a reader claims. When a new version of Firefox was installed without copying any passwords, it asked the user whether it should sign in to sites such as Social Security by importing login credentials from Edge. (I’ve highlighted Firefox’s request with an orange box.)  Source: Screen shot from reader’s smartphone

Other users have reported a similar sequence of events involving Edge and Chrome browser. In August, one poster said on the official Microsoft Answers forum for Edge:

I have no idea how this happened, but after updating my computer, Microsoft Edge opens up, which is normal I suppose, but they got my Google Chrome passwords and bookmarks without my consent …

Moderators quickly responded that Edge importing Chrome’s stored passwords without user approval “wasn’t very likely.” Edge is supposed to present the dialog box shown in Figure 2, asking whether to import or not import.

Figure 2
Figure 2. When Edge is installed, it’s supposed to present the user with a dialog box asking whether it can import saved passwords from whichever browser the user had previously used the most.  Source: Microsoft Answers page

The history of Edge’s and other browsers’ stored passwords is a bit hard to follow. As recently as June 2020, users complained that Edge had an “export passwords” function but no ability to import passwords from other browsers at all.

Much later, on April 21, 2021 — just three months ago — users began reporting in Microsoft Answers posts that Edge had gained an import feature, but only in a private Insider Channels build and then only if a special command line were entered.

A long article, updated by a Microsoft Ambassador, finally describes on July 2 all
the ins and outs of how Edge stores and manages passwords.

Separately, an undated and unsigned Microsoft support document explains the rules Edge follows when it decides whether to copy a previously installed browser’s saved passwords:

  • If the new Edge is being installed, and it finds that the user’s most-often-used previous browser was legacy Edge, the new Edge copies all of legacy Edge’s passwords and data without asking the user for consent. (This sounds suspiciously like the behavior that some users reported about Edge when Chrome or Firefox was their installed browser.)
  • If Edge finds a previously installed copy of Internet Explorer, Edge gives the user options to import saved passwords, favorites, browsing history, and other data types.
  • If the previously installed browser is Chrome, Edge gives the user the option to import saved passwords, favorites, browsing history, and nine other data types (including saved credit-card numbers).
  • If the previously installed browser is Firefox, Edge currently can import only four data types: saved passwords, favorites, browsing history, and addresses.
  • Other browsers, such as Brave, Safari, Opera, and Tor are apparently not supported by Edge’s new import function.

Whew! That’s a lot to take in. But you don’t need to remember all of the above. All you need to remember is that most browsers store your saved passwords in an unsecure way that malware can silently copy and send to a hacker’s server.

Without a master password, storing your passwords is a bad idea

I urged my readers to establish a “master password” way back in a November 23, 2004, article, which remarkably is still online. Back then, the exciting new browser was Firefox 1.0. It was the only browser that allowed you to enter an overall string that would encrypt your saved passwords, protecting them from snoopy co-workers and hidden malware. IE certainly couldn’t protect you.

I can’t believe that almost 17 years later I still need to ask people to do this. Browsers should encrypt your saved passwords by default. But most don’t.

The German Federal Office for Information Security (BSI, in German) audited Edge 44, IE 11, Chrome 76, and Firefox 68 in September 2019. Firefox was the only browser that supported a master password. (Mozilla now calls this the “primary password.”) Chrome and Edge also lacked an option to block telemetry collection and provide organizational transparency.

As a result, BSI recommended that German agencies and businesses use only Firefox. For more information, see a ZDNet article and a Forbes summary.

As recently as April 9, 2021, a poster at the Microsoft Tech Community forum announced that a master-password feature had been spotted in a beta version of Edge. However, it’s only a “controlled feature,” meaning it’s not yet in wide distribution.

As of July 6, Microsoft’s official feature roadmap for Edge said: “Require authentication before auto-filling passwords.” The target date was given as April 2021, but the status of this feature was still described as “in development.”

I asked Microsoft officials how Edge handles saved passwords from other browsers. According to Microsoft, “Microsoft Edge does not directly pop-up or autofill data from other browsers. Instead, customers have the option to import their browsing data from other browsers to Microsoft Edge based on their interest and consent.”

Regarding reports that Edge had copied saved-password files from Chrome and Firefox without user approval, Microsoft’s statement said this: “The Edge password import feature is now enabled by default in all Microsoft Edge Channels. It can be found on the edge://settings/passwords page inside the Overflow Menu of the Saved Passwords table. Microsoft is looking into the reports you shared and monitoring feedback to improve customer password import experiences.”

There’s good news on whether Edge will soon allow users to enter a master password that would encrypt any username/password combinations that Edge saves. “Microsoft will offer this functionality closer to end of July. If you are on a shared device or have left your computer unlocked, you can opt to add a second verification using your device password to avoid others accessing your website credentials or auto-fill data.”

The statement added: “For more information on Microsoft Edge’s encryption method, please see this support doc: Microsoft Edge password manager security.”

When someone who really knows what Edge is doing with passwords becomes available, I’ll write more about it in this space.

That Microsoft support document states: “Microsoft security baselines recommend disabling the password manager.” The reason is that a computer worm that compromises a network of PCs could obtain all the passwords stored by every browser on the network.

For all the above reasons, I’m going to tell you now not to store passwords in browsers at all.

Storing passwords in your browser was never a good idea

Despite the precautions browsers may take, your usernames and passwords are prime targets for hackers. Your stored credentials may include the keys to your bank account, your credit union, your credit cards, and more.

The Mitre Att&ck website lists in Document T1555.003 more than 70 attack vectors that are currently circulating to scrape your passwords out of whatever files various browsers store them in. The security group also lists numerous exploits that hack into the old Windows Credential Manager and even some password managers, such as KeePass.

Do you think your PC could never become silently infected by malware?

Don’t be so sure.

People who downloaded a completely legitimate, open-source video transcoder, HandBrake, learned only later that its server had been hacked. Installing the video app silently inserted OSX/Proton, a Trojan horse that was designed to infect Macs. The developer warned customers in a Web posting that half of all their downloads between May 2 and 6, 2017, had contained the malware, according to an Objective-See blog post.

More recently, viruses have emerged that constantly monitor the Windows Clipboard. This could lead to many nefarious acts, but the so-called Clipboard Wallet Hijacker watches for transactions that move digital currency from one of your wallets to another. If this occurs, the malware changes the destination from your crypto account to its own. The security firm 360 Total Security has detected this silent robber on more than 300,000 computers, according to a July 1 Laptop Mag article.

The solution is to install a serious password manager

As a first step to protect yourself, you should turn off all of your browsers’ capabilities to store usernames and passwords. Then delete any credentials it stored. Edge has a simple check-box to do this if you select Settings, Profiles, Passwords, as I explained in my May 17 column.

There are many good password managers, but in that same column I noted that 1Password is the top choice of CNET, Wirecutter, Wired, and several other test sites. It’s not free, costing $3/month for a single user or $5/month for five people. But 1Password is worth it for its support of industry standards and two-factor authentication (2FA) using small USB fobs as well as the MS Authenticator and Authy mobile apps.

Password managers can help you enter passwords into apps that aren’t websites and don’t use a browser. For instance, you may have programs that connect you to sensitive services without there being any webpage to sign in on.

Until a better system than usernames and passwords catches on, we all need to secure these valuable little character strings as best we can.

Scales of Justice Do you know something that we all should know? Tell me about it! I’ll keep your identity totally confidential or give you credit, as you prefer. Send your story via the Public Defender tips page.
Talk Bubbles Join the conversation! Your questions, comments, and feedback about this topic are always welcome in the AskWoody Lounge!

The PUBLIC DEFENDER column is Brian Livingston’s campaign to give you consumer protection from tech. If it’s irritating you, and it has an “on” switch, he’ll take the case! Brian is a successful dot-com entrepreneur, author or co-author of 11 Windows Secrets books, and author of the new book Muscular Portfolios. Get his free monthly newsletter.

LensesRX
If you purchase after clicking this ad, AskWoody may receive a small commission.
Stories in this week’s PAID AskWoody Plus Newsletter
Become an ASKWOODY PLUS member today!

LANGALIST

Fred Langa

Yikes! Still more subscriber OneDrive problems, solutions!

By Fred Langa

As our extensive OneDrive coverage winds down, many excellent reader-submitted reports continue to pour in, filled with interesting tips, questions, and observations!

Today’s column deals with several OneDrive topics: unexpected behavior from the OneDrive status-indicator icons; issues between and among OneDrive, Dropbox, and OEM updater apps; and more on redirecting or moving OneDrive’s default local folders.

HARDWARE

Ben Myers

The Trusted Platform Module has just become important

By Ben Myers

Microsoft has said that the Trusted Platform Module 2.0 is a firm requirement for Windows 11. Why?

And what is TPM, anyway?

BEST UTILITIES

Deanna McElveen

Three free tools to check Windows 11 compatibility

By Deanna McElveen

It’s a confusing time as Windows 11 approaches.

With Microsoft releasing new (sometimes conflicting) information about Windows 11 daily (sometimes hourly), the exhausted developers of the three free tools I am featuring have been playing catch-up for a few weeks now.

PATCH WATCH

Susan Bradley

MS-DEFCON 2 — To patch or not to patch

By Susan Bradley

Out of band for Print Nightmare

Microsoft dropped an “out of band” patch for a zero-day vulnerability. Named “Print Nightmare” by the media, the vulnerability presents the most risk for Domain controllers in Active Directory domains.


You’re welcome to share! Do you know someone who would benefit from the information in this newsletter? Feel free to forward it to them. And encourage them to subscribe via our online signup form — it’s completely free!


RoboForm box

Like what you see in the
AskWoody FREE newsletter?

Become a PLUS member!

As a Plus member, you’ll receive the full newsletter, including all our great content about Windows, Microsoft, Office, 365, PCs, MS-DEFCON Alert notifications, useful and safe freeware, and Susan Bradley’s sought-after patch advice. Plus membership also allows continuous access to the complete archive of nearly two decades of Windows Secrets and AskWoody Newsletters.

Naturally, Plus members have all the benefits of free membership, including access to the popular AskWoody forums.

The cost? We’re supported by donations — choose any amount for a one-year membership. Every little bit helps.

 Join AskWoody PLUS Today!


Publisher: AskWoody Tech LLC (sb@askwoody.com); editor: Will Fastie (editor@askwoody.com).

Trademarks: Microsoft and Windows are registered trademarks of Microsoft Corporation. AskWoody, Windows Secrets Newsletter, WindowsSecrets.com, WinFind, Windows Gizmos, Security Baseline, Perimeter Scan, Wacky Web Week, the Windows Secrets Logo Design (W, S or road, and Star), and the slogan Everything Microsoft Forgot to Mention all are trademarks and service marks of AskWoody Tech LLC. All other marks are the trademarks or service marks of their respective owners.

Your subscription:


Copyright © 2021 AskWoody Tech LLC, All rights reserved.