1

As stated in this article

JavaScript values are allocated when things (objects, strings, etc.) are created and "automatically" freed when they are not used anymore.

I recently took a heap snapshot of my browser after clicking trough the browser version of 1password.
To my surprise the passwords of every opened item were clearly readable in that snapshot.

I did not investigate a lot further in how it actually stores this data but I assume they use a separate object for every item and retrieve the cleartext password on the first time it's opened and leave it at that.

I'd like to know if there is a way to prevent this kind of behaviour (in my own apps) by handling data in a different way.
What if I were to only store/show the cleartext data in one and the same object that is overwritten with the new data when opening another item?

Screenshot of the 1password application
After opening both 'test' and 'test2' the passwords of both would be readable in the heapdump

  • 1
    Which browser? Firefox (Gecko) uses PresArena for allocation and Chrome (Blink) uses PartitionAlloc. – forest Jun 12 '18 at 12:35
  • This was in Vivaldi, a browser based on chromium/chrome – HTDutchy Jun 12 '18 at 12:37
  • Browser memory handling is very complex. To do what you want (if you mean wiping memory objects after they are freed) would likely require some heavy patches to the source code touching everything from object allocation to garbage collection and more. I doubt there's a config option for it. – forest Jun 12 '18 at 12:38
1

This should be a comment, but its a bit long.

"automatically" freed when they are not used anymore

Freed does not mean removed from memory, only that the data is eligible for garbage collection. They are inaccessible from Javascript but will likely persist in memory for some time.

the passwords of every opened item were clearly readable

What do you mean by "opened item" - if its a site you are were accesing around the time of the snapshot (bearing in mind that HTTP is stateless) this rather implies the data was in use.

I'd like to know if there is a way to prevent this behaviour

Do you intend writing your own password manager? Are you asking if 1password can be reconfigured to behave differently?

  • For every opened item: as you click an item it is opened in a html element, it is a single page js app if that helps my explanation. As for your second question, this would apply to (the theory of) writing my own in javascript. – HTDutchy Jun 12 '18 at 12:58
  • Given your description, the code is not just javascript. Given that you've based your question around a growing number of wrong guesses/assumptions, perhaps this isn't the time/place for such a launchpad? – symcbean Jun 12 '18 at 13:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.