Support NeoGAF

[winjer]

Microsoft Edge stores your passwords in plaintext RAM... on purpose

A security researcher showed that Edge passwords are plaintext readable in RAM. Microsoft confirmed the behavior is intentional.

www.pcworld.com

• PCWorld reports that Microsoft Edge's password manager stores all user passwords in plaintext RAM, creating a serious security vulnerability that allows local attackers to easily access credentials.
• Norwegian security researcher Tom Jøran Sønstebyseter Rønning discovered this flaw, which Microsoft confirms is a deliberate design decision rather than an accidental oversight.
• Users should immediately migrate their passwords from Edge to dedicated password managers, as authentication protection offers little defense against RAM access attacks.

Serious flaw in Edge's password manager

The vulnerability affects Microsoft Edge's password manager. Password managers typically use end-to-end encryption and store passwords in cloud storage so that users can access them from anywhere. When passwords are needed, password managers normally decrypt the them for use and then delete them afterwards.

The fact that Edge keeps all passwords loaded without any encryption is both unusual and dangerous. Other password managers, including those that are built into browsers, don't operate in this way—Rønning says Edge is the only Chromium-based browser he's tested with this behavior.

Edge does require authentication to view passwords in the password manager, but this is of little protective value if attackers can simply gain access by reading the RAM, which is what happens here.

This has to be one of Microsoft's biggest fuck ups ever. To be so incompetent as to expose users passwords in plain text, that can be read out of RAM.
And this is another reason why you should never use Microsoft Edge.

 

[AJUMP23]

What a terrible development.

 

[ReBurn]

It doesn't store my passwords in plain text because I don't trust browsers to store my passwords.

 

[IntentionalPun]

Could be exploited by malware. Needs to be fixed, but this is how pretty much all browsers worked just a few years ago. If you have malware running on your machine with your privileges you are pretty fucked in general, but this is worse as wouldn't even need a keylogger as all passwords are just there in memory.

 

[Dacvak]

Holy shit that's wild. How could they think that was a good idea?

 

[demigod]

If you use Edge, you deserve to have your passwords hacked.

 

[Trogdor1123]

If you use Edge, you deserve to have your passwords hacked.

I don't know, edge is alright. Better than Chrome that's for sure.

 

[forsakkenSoul]

I've used Edge before and was honestly kinda surprised, it's really stable and fast, I only stopped using it because my settings kept getting reset almost every week. I've also tried Brave, Vivaldi, and Chrome, they're all fine, but I still prefer good old Firefox.

 

[Fake]

Vibe coding.

 

[Magic Carpet]

'Password Manager'

They deserve to be raked over the coals for this bit of news.

 

[Gp1]

It doesn't store my passwords in plain text because I don't trust browsers to store my passwords.

Store that, Edge

 

[winjer]

 

[kruis]

https://www.darkreading.com/cyber-risk/microsoft-edge-passwords-enterprise-risk

"An attacker with administrative privileges can gain access to Microsoft Edge user passwords even when they're not in use, because the browser stores them in cleartext in process memory as part of a design decision by Microsoft.

Security researcher Tom Jøran Sønstebyseter Rønning revealed the issue and how it can be exploited in a proof-of-concept (PoC) tool at Palo Alto Networks Norway's BIG Bite of Tech conference last week. He subsequently posted resources for the PoC and tool on GitHub.

Hmmm ... if you're being attacked by someone with admin privileges on your own PC, it's already game over.

 

[Draugoth]

LibreWolf and Brave > Everything fucking else

 

[winjer]

LibreWolf and Brave > Everything fucking else

I have heard good things about Helium. Though I haven't tried it.

 

[Donald mac Ronald]

Microsoft make crappy products.

Tell me one piece of software in 15 years that's actually been better than mediocre

 

[Reizo Ryuu]

I also store my passwords in plain text on paper