Google Chrome security flaw offers unrestricted password access (opens in new tab)

This is a big deal because it makes reading passwords easy to do in seconds, and easy to do inconspicuously.

If you were to modify the DOM to unmask passwords it would take longer, and it's not something you can do while a co-worker or friend lends you their laptop for a minute. This flaw presents additional opportunity to anyone who wants to read another person's passwords.

It is not merely "cosmetic." It actually presents a real problem for anyone who does not logout of their account every time someone else uses their computer. Sure, this is probably best practice — but it is also insulting, inconvenient and an unrealistic expectation.

If I have unrestricted access to your machine, your passwords are compromised. Fine. But this is not a common or realistic scenario. It is far more likely I am using your machine with you, and then you walk out for 20 seconds to get a glass of water.

* An FBI warning, like they have on DVDs, explaining the penalties for stealing user passwords.

* Automatically generate word-search puzzles like on the backs of chain restaurant kids menus, so that 5 year olds will have a harder time recovering passwords.

* Since most of the "attackers" the master password would block are probably senior citizens, typeset the passwords in a 7 point font.

* Since all of the "attackers" who would be thwarted by a Chrome master password are computer illiterate, make users answer a basic computer literacy quiz before showing them the password. You should have to be able to explain the difference between a library function and a system call when you push the "reveal password" button.

Note to The Guardian: I have at least 10 more similar "major security flaws" in Chrome (I gave up some more, like the red-green colorblind attacker countermeasure, on Twitter --- but I assure you I have 10 more) that I'm willing to disclose to you, and I assure you that you'll be able to find someone else on the Internet to give you quotes for your article about how terrible it is that Chrome has those flaws.

And please explain how to bypass Safari password manager, or 1Password, or any password manager with a master password, if you believe it's only a cosmetic feature.

Chrome is designed for the layman.

Does it warn you that your passwords are effortlessly stolen by anyone that can access your computer? No.

Does it warn you they're at least not encrypted? No.

Do you think the average Chrome user knows this?

Do you think the average user understands computer security like us IT professionals?

It actually is impossible for malware to instantly send off all of your saved passwords if you're using Firefox and have a (reasonably decent) master key set up. I assume Opera has a similar master key option. The keyword however is "instantly."

Now, the malware can and will still of course modify HTML on the fly and steal your passwords immediately after you login to websites, but it would probably take quite a bit of time for it to collect nearly as many passwords as there are stored in your browser's password vault, especially if you use websites that don't require you to re-login very often. And the longer that time window is, the higher the chance the malware will be detected either by odd computer behavior, or an AV detection.

They can also set up a keylogger and wait for you to input your master password at some point. It can sometimes be hard to determine what logged text is actually the master pass, due to how many keyloggers work, but this is of course a viable option.

All-in-all, master passwords do in fact hinder attackers. The first thing many malware spreaders do is dump browser and other saved credentials (often FTP, sometimes IM accounts so they can spam malicious links to contact lists); it's often a quick "in-and-out" dumping process. It's not uncommon for malware to successfully execute and exfiltrate some data as soon as it's loaded, but later as it infects other files or drops additional payloads, AV will fire and the user will try to clean up the machine.

And then there are the very simple cases of "friend/acquaintance uses computer, looks at your passwords really quickly, memorizes a few, goes home and screws with your accounts at a later time." Master passwords make that sort of situation fairly impossible.

I really do not personally see why Chrome doesn't allow master passwords as an option. It would not be a security silver bullet, but it does help.

Either it tells you that your passwords are readable (and thus you are less likely to trust it) or it makes some attempt to prevent your passwords from being read within seconds. It can't have it both ways.

He isn't just some random commenter though, he is the tech lead of browser security (according to his comment, which I'm guessing The Guardian didn't actually verify :D)

Alternatively Chrome should inform the user that saved passwords are easily readable in plaintext, so that users will not trust it as much. It does not do this either.

There's a difference between browsing someone's private documents and having permanent access to their email account via their password.