0

I was very surprised and alarmed to see that a free software could list passwords stored by browser in plain text. I thought that these passwords (such as the ones for email) are encrypted and can't be viewed that easy! I thought that cookies are such files.

This means that any web application could do the same and "steal" this information without me knowing!

My question is, is there a browser setting that prevents the storage of such credentials?

2

Different browsers do this differently, but in general: If you want to make your passwords unreadable for other software on your computer, you'll need to set a master password that you have to enter before you can access your ordinary passwords.

Without a master password, the browser has no secret to derive an encryption key from. Sure, it could just pick one at random, but then it would have to store it somewhere and other programs could just read it from wherever it is stored.

As for "any web application", note that web sites generally can't read from disk, so they can't read your passwords no matter if they are encrypted or not. This is an issue with desktop applications, not web applications.

  • Thank you very much for your answer. I though that web application could read their cookies, I guess that is how one could get into his/her email without logging on every time. – NoChance Jul 6 at 12:15
  • 1
    @NoChance Yes, web applications can read their own cookies, but not cookies from other web sites. A well design web application would not store the password in a cookie though, but instead use session id. – Anders Jul 6 at 12:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.