Obviously the first answer is "a malicious application can do much worse than that." However, it seems like a really easy thing for an application to read your cookies, saved passwords, etc. from your browser settings that are saved in your browser's folder inside AppData (on Windows). It seems like a really hard thing for antivirus to detect, since AppData is supposed to have easy read/write permissions for all apps. Is there anything to stop software from silently reading this information alongside its normal function?
4
-
Nothing. I heard some browsers encrypted their password store, but even then, they need some way of decrypting it, unless it's a master password the user enters each time he opens the browser.– user42178Dec 12, 2014 at 2:19
-
@AndréDaniel That happens to be exactly how Firefox handles encrypting the password store.– cpastDec 12, 2014 at 2:41
-
@cpast So combating what I described in my question is the actual reason behind Firefox having a master password system?– KeavonDec 12, 2014 at 3:47
-
@Keavon Well, partly. The reason for a master password is largely to keep someone who gets the password DB from reading the contents, but it's also in part to keep someone who gets temporary access to Firefox from looking at all your passwords (which is why it prompts again before showing you the whole list of saved passwords, besides the just-at-startup prompt to log in with saved passwords.– cpastDec 12, 2014 at 5:11
Add a comment
|
1 Answer
This can very well be a concern. Different browsers handle it different ways. Chrome passwords on Windows are not stored in some file in AppData; they're stored using Windows's DPAPI, which means that they're encrypted with a key derived from your Windows password, so they're secure if someone doesn't have access to your Windows account. However, while it's not necessarily trivial for other programs running under your user account to access the passwords, it's by no means impossible to do so. The basic principle seems to have been "there actually is no secure way to have the passwords stored in memory (not on disk) and keep other programs from accessing them, so let's not pretend there is" -- thus, for a long time, it didn't prompt you for a master password at all (you were logged in, and that's your master password. Nowadays, they have implemented a Windows password prompt to view stored passwords; there's no technical benefit, but it's much harder to casually view someone else's passwords.
Firefox instead implemented its own crypto modules from scratch, starting from Netscape days (other browsers tend to use OS functions for crypto). Its passwords are encrypted by Firefox, with an optional master password that the user must enter before it will autofill passwords (and again each time you want to show all passwords). This is probably more secure when Firefox is not running -- the Chrome password DB is open to all programs running as your user, but the Firefox one is only open when Firefox is actually running.
However, when Firefox is running, any program running as you can see what it has in memory. Because it doesn't prompt for a master password each and every time you need a password filled, other programs can then read the password DB because you decrypted it for Firefox. They can do this until Firefox is closed.
