Tweeted twitter.com/StackSecurity/status/912360068833738752

occurred Sep 25, 2017 at 16:56

The edited headline didn't really reflect my question. It's not meant to be Chrome-specific, and the edited headline seemed a bit naive.

Source Link

edited Sep 24, 2017 at 12:34

Martin Fürholz

850
10
21

How can I replicate Chromes behavior where Is there a way to make the Google passwords are not contained inbrowser remove the memorylogin-dump for other sitespassword from it's memory immediately, like Chrome seems to do on accounts.google.com?

I did some testing, and found that a memory dump of Chrome doesn't hold the password of gmail.com/Google after logging in to that site (the login happens on accounts.google.com).

(My System is Windows 10 64bit Professional, Chrome 60).

I can find the passwords of all other sites I've tested. Also when I do the same in Firefox, the gmail.com password will be stored in the memory dump. This is a Chrome-specific behaviour.

I've tried a lot of things to prevent the password from being stored in a memory-dump. Even when I hash the password in the password-field before submitting the form, the original (un-hashed) password will be contained in the memory dump. I tried with autocomplete="off", I tried sending the password through a 'hidden' field, and an invisible text field. (So that the browser won't attempt to store the password in the built-in password-manager).

I've also - of course - tried with deactivated password-storage, cleared the cache, experimented with Cache-Control/Pragma/Expires -headers, and what not. And I know that the Gmail-website does indeed send the unhashed/original password in the request to the server. So there is no client-side method involved to encrypt/hash/obfuscate the password.

So my question is: whatever gmail.com (accounts.google.com) uses so that the password is not contained in a memory dump, would it be possible to do the same for my own website? Or is that possibly a hardcoded, gmail.com-specific feature of the Chrome-browser?

Could it be coincidence, because that site causes a lot of read-/write-activity on the memory, so that the Garbage Collector cleans up faster, or something like that?

How can I replicate Chromes behavior where the Google passwords are not contained in the memory-dump for other sites?

I did some testing, and found that a memory dump of Chrome doesn't hold the password of gmail.com/Google after logging in to that site.

(My System is Windows 10 64bit Professional, Chrome 60).

I can find the passwords of all other sites I've tested. Also when I do the same in Firefox, the gmail.com password will be stored in the memory dump. This is a Chrome-specific behaviour.

I've tried a lot of things to prevent the password from being stored in a memory-dump. Even when I hash the password in the password-field before submitting the form, the original (un-hashed) password will be contained in the memory dump. I tried with autocomplete="off", I tried sending the password through a 'hidden' field, and an invisible text field. (So that the browser won't attempt to store the password in the built-in password-manager).

I've also - of course - tried with deactivated password-storage, cleared the cache, experimented with Cache-Control/Pragma/Expires -headers, and what not. And I know that the Gmail-website does indeed send the unhashed/original password in the request to the server. So there is no client-side method involved to encrypt/hash/obfuscate the password.

So my question is: whatever gmail.com uses so that the password is not contained in a memory dump, would it be possible to do the same for my own website? Or is that possibly a hardcoded, gmail.com-specific feature of the Chrome-browser?

Could it be coincidence, because that site causes a lot of read-/write-activity on the memory, so that the Garbage Collector cleans up faster, or something like that?

Is there a way to make the browser remove the login-password from it's memory immediately, like Chrome seems to do on accounts.google.com?

I did some testing, and found that a memory dump of Chrome doesn't hold the password of gmail.com/Google after logging in to that site (the login happens on accounts.google.com).

(My System is Windows 10 64bit Professional, Chrome 60).

I can find the passwords of all other sites I've tested. Also when I do the same in Firefox, the gmail.com password will be stored in the memory dump. This is a Chrome-specific behaviour.

I've tried a lot of things to prevent the password from being stored in a memory-dump. Even when I hash the password in the password-field before submitting the form, the original (un-hashed) password will be contained in the memory dump. I tried with autocomplete="off", I tried sending the password through a 'hidden' field, and an invisible text field. (So that the browser won't attempt to store the password in the built-in password-manager).

I've also - of course - tried with deactivated password-storage, cleared the cache, experimented with Cache-Control/Pragma/Expires -headers, and what not. And I know that the Gmail-website does indeed send the unhashed/original password in the request to the server. So there is no client-side method involved to encrypt/hash/obfuscate the password.

So my question is: whatever gmail.com (accounts.google.com) uses so that the password is not contained in a memory dump, would it be possible to do the same for my own website? Or is that possibly a hardcoded, gmail.com-specific feature of the Chrome-browser?

Could it be coincidence, because that site causes a lot of read-/write-activity on the memory, so that the Garbage Collector cleans up faster, or something like that?

I also experimented with various no-cache- headers.

Source Link

edited Sep 23, 2017 at 8:34

Martin Fürholz

850
10
21

I did some testing, and found that a memory dump of Chrome doesn't hold the password of gmail.com/Google after logging in to that site.

(My System is Windows 10 64bit Professional, Chrome 60).

I can find the passwords of all other sites I've tested. Also when I do the same in Firefox, the gmail.com password will be stored in the memory dump. This is a Chrome-specific behaviour.

I've tried a lot of things to prevent the password from being stored in a memory-dump. Even when I hash the password in the password-field before submitting the form, the original (un-hashed) password will be contained in the memory dump. I tried with autocomplete="off", I tried sending the password through a 'hidden' field, and an invisible text field. (So that the browser won't attempt to store the password in the built-in password-manager).

I've also - of course - tried with deactivated password-storage, cleared the cache, experimented with Cache-Control/Pragma/Expires -headers, and what not. And I know that the Gmail-website does indeed send the unhashed/original password in the request to the server. So there is no client-side method involved to encrypt/hash/obfuscate the password.

So my question is: whatever gmail.com uses so that the password is not contained in a memory dump, would it be possible to do the same for my own website? Or is that possibly a hardcoded, gmail.com-specific feature of the Chrome-browser?

Could it be coincidence, because that site causes a lot of read-/write-activity on the memory, so that the Garbage Collector cleans up faster, or something like that?

I did some testing, and found that a memory dump of Chrome doesn't hold the password of gmail.com/Google after logging in to that site.

(My System is Windows 10 64bit Professional, Chrome 60).

I can find the passwords of all other sites I've tested. Also when I do the same in Firefox, the gmail.com password will be stored in the memory dump. This is a Chrome-specific behaviour.

I've tried a lot of things to prevent the password from being stored in a memory-dump. Even when I hash the password in the password-field before submitting the form, the original (un-hashed) password will be contained in the memory dump. I tried with autocomplete="off", I tried sending the password through a 'hidden' field, and an invisible text field. (So that the browser won't attempt to store the password in the built-in password-manager).

I've also - of course - tried with deactivated password-storage, cleared the cache, and what not. And I know that the Gmail-website does indeed send the unhashed/original password in the request to the server. So there is no client-side method involved to encrypt/hash/obfuscate the password.

So my question is: whatever gmail.com uses so that the password is not contained in a memory dump, would it be possible to do the same for my own website? Or is that possibly a hardcoded, gmail.com-specific feature of the Chrome-browser?

Could it be coincidence, because that site causes a lot of read-/write-activity on the memory, so that the Garbage Collector cleans up faster, or something like that?

I did some testing, and found that a memory dump of Chrome doesn't hold the password of gmail.com/Google after logging in to that site.

(My System is Windows 10 64bit Professional, Chrome 60).

I can find the passwords of all other sites I've tested. Also when I do the same in Firefox, the gmail.com password will be stored in the memory dump. This is a Chrome-specific behaviour.

I've tried a lot of things to prevent the password from being stored in a memory-dump. Even when I hash the password in the password-field before submitting the form, the original (un-hashed) password will be contained in the memory dump. I tried with autocomplete="off", I tried sending the password through a 'hidden' field, and an invisible text field. (So that the browser won't attempt to store the password in the built-in password-manager).

I've also - of course - tried with deactivated password-storage, cleared the cache, experimented with Cache-Control/Pragma/Expires -headers, and what not. And I know that the Gmail-website does indeed send the unhashed/original password in the request to the server. So there is no client-side method involved to encrypt/hash/obfuscate the password.

So my question is: whatever gmail.com uses so that the password is not contained in a memory dump, would it be possible to do the same for my own website? Or is that possibly a hardcoded, gmail.com-specific feature of the Chrome-browser?

Could it be coincidence, because that site causes a lot of read-/write-activity on the memory, so that the Garbage Collector cleans up faster, or something like that?

Change the title to be consistent with the question content

Link

edited Sep 23, 2017 at 8:21

Steffen Ullrich

207.5k
30
416
481

How can I prevent thatreplicate Chromes behavior where the loginform-password isGoogle passwords are not contained in athe memory-dump of the browser (Chrome)for other sites?

Source Link

asked Sep 23, 2017 at 7:21

Martin Fürholz

850
10
21

Loading

Stack Exchange Network

Return to Question

How can I replicate Chromes behavior where Is there a way to make the Google passwords are not contained inbrowser remove the memorylogin-dump for other sitespassword from it's memory immediately, like Chrome seems to do on accounts.google.com?

How can I replicate Chromes behavior where the Google passwords are not contained in the memory-dump for other sites?

Is there a way to make the browser remove the login-password from it's memory immediately, like Chrome seems to do on accounts.google.com?

How can I prevent thatreplicate Chromes behavior where the loginform-password isGoogle passwords are not contained in athe memory-dump of the browser (Chrome)for other sites?