Why do I need to provide authentication when accessing a browser's built-in password manager?

Question

Why do I have to provide authentication when I want to read a password stored in my own web browser while I have to do nothing to read the same password on a site's login page?

Is my conclusion correct that asking the user for a PIN is pointless and adds nothing to security or am I missing something (please, clarify, how asking for PIN increases security)?

---

The problem

When I am using my browser and want to access my stored passwords, I (nearly) always have to authenticate:

But when I am browsing web pages, I don't have to authenticate (or take any other security-related measures) to have the browser provide the site's password:

What am I missing? Why is this inconsistent?

---

This question is just for browsers and doesn't correspond to any kind of password manager. What is the point of asking for PIN each and every about 1 minute when I am using the browser's password manager if I can get access to the entire password database without that PIN, by just visiting each and every website stored in that password manager and clicking "Show password" or an eye icon? It is just a few clicks more (per password).

Answer 1

Three reasons. In decreasing order of security importance:

1. The password viewer gives a quick view of all the stored passwords. An attacker who gains access to your unlocked machine probably only has a short window of access, so a screen that lets them quickly display all of the passwords (while, e.g., photographing with their phone) is much more useful to the attacker than manually going to each different site, autofilling the password, and revealing it.
2. Not all sites offer a mechanism to reveal the password. It's always possible from the developer tools (along with a few other ways to read the value), but that's even more work. Offering the ability to reveal the password is a choice the site developer makes when they're willing to trade away some security for some user convenience. It's not up to the browser developer to make that decision for every site.
3. Users expect it, and whether a user feels that the product is secure is often much more significant to its success in the marketplace than whether the feature in question actually provides any security. Consider stupid stuff like banks that pop a loading screen (often for much longer than the actual load time) after logging in, which just says "Securing your session" or some such. Or sites that use padlock icons because users associate them with security, even though the icon means literally nothing. There is a definite sense in which this browser "feature" is security theater, but if you spend much time on this site, you will also see plenty of examples of people complaining about, and calling insecure, products that don't implement such security theater. For another example: Chrome on Windows and MacOS uses platform encryption functions to security your cookies, site data, and passwords. On Linux, by default there is no such platform feature, so it "secures" them by encrypting with a hardcoded key. This provides no meaningful security whatsoever, but it means you can't find your cookies in plain text if you search the relevant files on your drive, and people like that.

Answer 2

I believe this is an attempt to block an unauthorized user with physical access to your computer from accessing the password database to quickly obtain all your passwords at once before you come back from your coffee break.

Any hacker that has the credentials to remotely sign in to your browser will be able to authenticate himself when prompted to reenter the credentials to access the database. So in the case of a remote hacker, this safeguard is useless.

But in a case where a not-too-technically-savvy snooper has physical access to your computer, and wants to physically access your password database, this safeguard will go a long way in protecting your info.

In regards to your questioning what purpose there is to requesting your pin before displaying the password database, this should answer it.

Answer 3

Yes - your conclusion, as well as the other answers, are correct in that the PIN code adds nothing to the security of password storage for a logged in user against certain threats, rather, it's (probably) there to counter opportunistic threats.

Here's some doco to back that up, from Microsoft Edge password manager security Aug'22 versions 77+ ...

However, physically local attacks and malware are outside the threat model and, under these conditions, encrypted data would be vulnerable. If your computer's infected with malware, an attacker can get decrypted access to the browser's storage areas.

...

However, using a password manager that's keyed to the user’s operating system login session also means that an attacker in that session can immediately retrieve all the user’s saved passwords. Without a password manager to steal from, an adversary would need to track keystrokes or monitor submitted passwords.

... and a bit further on, in the event of data at rest being stolen ...

Despite its inability to protect against full-trust malware, Local Data Encryption is useful in certain scenarios. For example, if an attacker finds a way to steal files from the disk without the ability to execute code or has stolen a laptop that isn’t protected with Full Disk Encryption, Local Data Encryption will make it harder for the thief to get the stored data.

A second document also talks about using the PIN code to guard against opportunistic threats, Additional privacy for your saved passwords Jul'21 (note the word privacy) ...

However, this latest update isn't a fix-all. It's very important to understand what this feature can do and what it can't. This is only a basic level of deterrence that provides an additional safeguard for your stored passwords. To best protect the passwords you’ve saved in Microsoft Edge while others are using your device, Microsoft recommends that those users sign in with their own user account on your device.

and

Important: This setting can't guarantee protection against malicious hackers or protect you against a motivated attacker. Malware or keyloggers installed on your device will still be able to read your passwords and attackers who can access your device can also turn off this setting if they know the device password.

PURE SPECULATION ... it may be that in the future, some additional hardening is to be added to the Edge browser pwd storage... ?

The Microsoft security team has currently rated the impact of a worm that compromises a network of Enterprise PCS (resulting in loss of all credentials in all devices’ password managers) as more severe than the (more likely but lower impact) risk of targeted phishing attacks that compromise a single user-entered credential. This assessment is under discussion and subject to change with the addition of new security-enhancing features in Microsoft Edge.

and from the second document referenced...

"A peek into the future" With this helpful first step, you get additional privacy for your passwords stored in Microsoft Edge. However, in certain scenarios where a device is shared among multiple people, the device password is likely known to all of them as well. In such situations, there is greater peace of mind in having password autofill guarded with a dedicated custom password that isn't shared with others. This capability is in the works, and will be brought to Microsoft Edge in the near future.