I just read a couple of very interesting discussions on Chrome password security strategy.
The following is how Chrome, Firefox and Safari handle storing passwords and showing stored passwords:
Chrome uses OSX Keychain to store passwords in encrypted form. In Chrome, you can go to the password settings page and with one click you can see your passwords.
Firefox doesn't uses the OSX Keychain to store passwords in encrypted form. In Firefox, you have the option to use a Master Password (not enabled by default). You type the master password at the beginning of every new session and every time you want to view stored passwords.
Safari also uses the OSX Keychain to store passwords in encrypted form. However, in Safari when you want to see the passwords, you need to enter the KeychainLogin password. (It is a 'fake' measure, because Keychain doesn't actually require authenticated applications to enter the KeychainLogin password to retrieve the passwords stored by them. This can be seen when Safari retrieves the passwords on website login prompts without the need for KeychainLogin password.)
Given new sessions of Safari and Chrome and a malicious user who doesn't know the KeychainLogin password. Safari is, in effect, no secure than Chrome because the user can just change the type of the password field to text using the inspect element tool and see the password.
My question is:
1) Given an attacker who doesn't know the Firefox master password and a new Firefox session (which hasn't asked for the master password yet), how easy/hard is it to see the stored passwords?
2) If the firefox master password is different than the OS user account password, does knowing the user account password change anything?
I am asking this because in one of the above discussions the security tech lead of Chrome says:
I'm the Chrome browser security tech lead, so it might help if I explain our reasoning here. The only strong permission boundary for your password storage is the OS user account. So, Chrome uses whatever encrypted storage the system provides to keep your passwords safe for a locked account. Beyond that, however, we've found that boundaries within the OS user account just aren't reliable, and are mostly just theater.
Consider the case of someone malicious getting access to your account. Said bad guy can dump all your session cookies, grab your history, install malicious extension to intercept all your browsing activity, or install OS user account level monitoring software. My point is that once the bad guy got access to your account the game was lost, because there are just too many vectors for him to get what he wants.
We've also been repeatedly asked why we don't just support a master password or something similar, even if we don't believe it works. We've debated it over and over again, but the conclusion we always come to is that we don't want to provide users with a false sense of security, and encourage risky behavior. We want to be very clear that when you grant someone access to your OS user account, that they can get at everything. Because in effect, that's really what they get.