1

Why do I have to provide authentication when I want to read a password stored in my own web browser while I have to do nothing to read the same password on a site's login page?

Is my conclusion correct that asking the user for a PIN is pointless and adds nothing to security or am I missing something (please, clarify, how asking for PIN increases security)?


The problem

When I am using my browser and want to access my stored passwords, I (nearly) always have to authenticate:

enter image description here

But when I am browsing web pages, I don't have to authenticate (or take any other security-related measures) to have the browser provide the site's password:

enter image description here

What am I missing? Why is this inconsistent?


This question is just for browsers and doesn't correspond to any kind of password manager. What is the point of asking for PIN each and every about 1 minute when I am using the browser's password manager if I can get access to the entire password database without that PIN, by just visiting each and every website stored in that password manager and clicking "Show password" or an eye icon? It is just a few clicks more (per password).

15
  • Because one is trying to see the entire password database, and one requires you to have navigated to a site and see that sites password. One is a database that can be accessed with access to the system. The other requires interactive access to the account to navigate site by site.
    – schroeder
    Jan 8 at 18:02
  • @schroeder From technical perspective, you are correct. From user perspective -- absolutely not. I can: (1) go to password manager, (2) click a link / URL next to every item, (3) go to that website, (4) see the login screen, (5) click "Show password" checkbox and (6) reveal password (without providing a PIN). In exactly the same way, as I would reveal it by clicking the eye icon in password manager (being forced to know / provide PIN). It's just a matter of taking more steps. But doesn't block me from revealing all my 777 passwords without knowing a PIN.
    – trejder
    Jan 8 at 18:38
  • @schroeder From this perspective, the need of providing PIN directly in password manager is nothing else than a nasty and irritating user bottleneck. But it add absolutely nothing to the security. Because it does not stop me from learning this password anyway, without knowing the PIN or scanning the fingerprint.
    – trejder
    Jan 8 at 18:40
  • as far as i'm aware, not all sites provide for a "view the password" option? also, it might be an ms-edge thing possibly integrating with windows logged in account secure storage, eg. try copying the profile folder to a new account and see if you can still view the pwds? (ie. in firefox i can set a master aka. primary password, and then none of those pwds are usable or visible, unless i've logged in and provided the key-material - lifting the pwd db from storage will be useless - you would also need the key from ram)
    – brynk
    Jan 8 at 19:47
  • 1
    You do know that there is a setting to require the device authentication when filling in site passwords, right?
    – schroeder
    Jan 11 at 10:37

3 Answers 3

1

Three reasons. In decreasing order of security importance:

  1. The password viewer gives a quick view of all the stored passwords. An attacker who gains access to your unlocked machine probably only has a short window of access, so a screen that lets them quickly display all of the passwords (while, e.g., photographing with their phone) is much more useful to the attacker than manually going to each different site, autofilling the password, and revealing it.
  2. Not all sites offer a mechanism to reveal the password. It's always possible from the developer tools (along with a few other ways to read the value), but that's even more work. Offering the ability to reveal the password is a choice the site developer makes when they're willing to trade away some security for some user convenience. It's not up to the browser developer to make that decision for every site.
  3. Users expect it, and whether a user feels that the product is secure is often much more significant to its success in the marketplace than whether the feature in question actually provides any security. Consider stupid stuff like banks that pop a loading screen (often for much longer than the actual load time) after logging in, which just says "Securing your session" or some such. Or sites that use padlock icons because users associate them with security, even though the icon means literally nothing. There is a definite sense in which this browser "feature" is security theater, but if you spend much time on this site, you will also see plenty of examples of people complaining about, and calling insecure, products that don't implement such security theater. For another example: Chrome on Windows and MacOS uses platform encryption functions to security your cookies, site data, and passwords. On Linux, by default there is no such platform feature, so it "secures" them by encrypting with a hardcoded key. This provides no meaningful security whatsoever, but it means you can't find your cookies in plain text if you search the relevant files on your drive, and people like that.
8
  • Thanks! Quick comments: (1) Good point, thanks! (2) Not any longer. Edge has Show the "Reveal password" button in password fields as a configuration switch. Password field is just an <input type="hidden"> which browser (with above setting) can easily override and website developer has literally nothing to do about it (unless using some swifty-nifty JavaScript code). (3) What about users (like me) who hates entering their PIN or touching their fingerprint reader each and every 30 seconds? What about keyboard readers that reads my PIN each an every 30 seconds, because of this stupid feature?
    – trejder
    Jan 11 at 10:38
  • @trejder why are you reauthenticating so much? (i.e. "every 30 seconds")
    – schroeder
    Jan 11 at 10:41
  • @schroeder Ask my Edge. I don't know, if this is exactly 30 or 60 seconds, but anyway quite (irritating) often.
    – trejder
    Jan 11 at 13:24
  • @trejder no no, what are you accessing that requires such frequent re-authentication? Are you opening up the browser password store multiple times during the day?
    – schroeder
    Jan 11 at 13:35
  • @schroeder Yes. I am in the middle of "cleaning" passwords (changing weak or doubled into unique ones) and porting certain of them to my KeePasses.
    – trejder
    Jan 11 at 17:26
2

I believe this is an attempt to block an unauthorized user with physical access to your computer from accessing the password database to quickly obtain all your passwords at once before you come back from your coffee break.

Any hacker that has the credentials to remotely sign in to your browser will be able to authenticate himself when prompted to reenter the credentials to access the database. So in the case of a remote hacker, this safeguard is useless.

But in a case where a not-too-technically-savvy snooper has physical access to your computer, and wants to physically access your password database, this safeguard will go a long way in protecting your info.

In regards to your questioning what purpose there is to requesting your pin before displaying the password database, this should answer it.

0

Yes - your conclusion, as well as the other answers, are correct in that the PIN code adds nothing to the security of password storage for a logged in user against certain threats, rather, it's (probably) there to counter opportunistic threats.

Here's some doco to back that up, from Microsoft Edge password manager security Aug'22 versions 77+ ...

However, physically local attacks and malware are outside the threat model and, under these conditions, encrypted data would be vulnerable. If your computer's infected with malware, an attacker can get decrypted access to the browser's storage areas.

...

However, using a password manager that's keyed to the user’s operating system login session also means that an attacker in that session can immediately retrieve all the user’s saved passwords. Without a password manager to steal from, an adversary would need to track keystrokes or monitor submitted passwords.

... and a bit further on, in the event of data at rest being stolen ...

Despite its inability to protect against full-trust malware, Local Data Encryption is useful in certain scenarios. For example, if an attacker finds a way to steal files from the disk without the ability to execute code or has stolen a laptop that isn’t protected with Full Disk Encryption, Local Data Encryption will make it harder for the thief to get the stored data.

A second document also talks about using the PIN code to guard against opportunistic threats, Additional privacy for your saved passwords Jul'21 (note the word privacy) ...

However, this latest update isn't a fix-all. It's very important to understand what this feature can do and what it can't. This is only a basic level of deterrence that provides an additional safeguard for your stored passwords. To best protect the passwords you’ve saved in Microsoft Edge while others are using your device, Microsoft recommends that those users sign in with their own user account on your device.

and

Important: This setting can't guarantee protection against malicious hackers or protect you against a motivated attacker. Malware or keyloggers installed on your device will still be able to read your passwords and attackers who can access your device can also turn off this setting if they know the device password.

PURE SPECULATION ... it may be that in the future, some additional hardening is to be added to the Edge browser pwd storage... ?

The Microsoft security team has currently rated the impact of a worm that compromises a network of Enterprise PCS (resulting in loss of all credentials in all devices’ password managers) as more severe than the (more likely but lower impact) risk of targeted phishing attacks that compromise a single user-entered credential. This assessment is under discussion and subject to change with the addition of new security-enhancing features in Microsoft Edge.

and from the second document referenced...

"A peek into the future" With this helpful first step, you get additional privacy for your passwords stored in Microsoft Edge. However, in certain scenarios where a device is shared among multiple people, the device password is likely known to all of them as well. In such situations, there is greater peace of mind in having password autofill guarded with a dedicated custom password that isn't shared with others. This capability is in the works, and will be brought to Microsoft Edge in the near future.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.