Slashdot Mirror
Safari and Chrome: Tied For the Worst Password Manager
Startled Hippo writes "Safari and Chrome are tied for the worst password manager built into a major Web browser, according to a new study on the issue produced by Chapin Information Services. One problem is that some password managers can be tricked into submitting different password credentials to different parts of the same Web site. The bug has been fixed in Firefox, but Chrome and Safari are still vulnerable to this kind of attack."
http://www.bash.org/?244321
Luckikly, all my passwords are exactly the same, so I'm fine.
...So I'm safe, right? ;-)
To be honest, when the best browser is only scoring 7/21 they *all* need some work. Focusing on Chrome just means you're ignoring the bigger picture.
If you can't remember your password then write it on paper and hide it. Putting it on your computer, especially your Windows PC, is asking for someone take it.
Even if they aren't in clear text the downside to using a password manager is everyone's passwords will be in the same place and in the same format. It's easy pickings.
"How can this be exploited" when some subtree memeber of a domain can read credentials that should only be given to the top level member, read http://www.linuxjournal.com/content/understanding-kaminskys-dns-bug.
To save the others the hassle, allow me to sketch something. It's trivial to get the domain a000001.amazon.com under your control. It is, believe me, if you don't, just read it up. Well, maybe not exactly a0000001... but something to the quality of $foo.amazon.com can easily be made to point back to a webpage you control.
Next, create a page for the internets most sought after resource: pr0n. Do like the missionaries, spread the word, unlike them you have ICQ and spam at your disposal to get people to visit your page. On this page, refer to $foo.amazon.com
Then have $foo.amazon.com ask for the credentials.
It's not so much that the threat of hijacking a "real" domain name (i.e. amazon.com itself) is too big after a few ISPs toughened their DNS lookups when the patches didn't come quickly. Few ISPs are left that are actually vulnerable to having their caches completely rewritten. Subdomains can still be hijacked (even after the half-assed patch we got lately), and in combination with browsers that send credentials to whatever subdomain, it's a serious security problem.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Who??
Seriously, this looks like a typical "storm in a teacup to get people to take me seriously as a security researcher" notification.
Who here really lets any password manager save any password they care about? I have Opera save details for systems that don't matter, everything else I just remember.
Check out the website for more information about this astounding company.
Oh arse
Putting passwords in your web browser isn't just like hiding your house keys under the doormat, it's like taping the keys of your house to the front door.
I don't keep full passwords on paper, nor do I use one of those password vault devices. Using truly random characters just means I have to write it down in full somewhere. I do have a text file that gives me *just* enough info that my mind can recall the password. For example, I might write "B`" and I recall that means "b1ZZare`" or I might use "W.P" to remember "To1.st0y". I know the rules I use to spell or punctuate words. I use different sorts of passwords for different tiers of security, from web forum, web merchant, web banking, private data, estate data, etc.
[
I never understood the appeal of password managers. And they tend to be obnoxious, getting in your face until you disable them.
If I have a high security password, I'm not going to want to store it in a browser for two reasons: 1) Someone else with physical accesse to my machine, has access to my stuff; 2) If I don't ever have to type my password, I'll often forget it.
For lower-security passwords, I, like many, simply use the same one that's easy to remember, and used for all those stupid forums and other lightweight places that make you register.
I've just never seen the need... It's definitely one of the most hyped up features that seems to have zero utility to me.
Love many, trust a few, do harm to none.
Comment removed based on user account deletion
I've always thought storing passwords in your computer is dumb. (1) It makes it extremely easy for people to steal your PC or laptop and get into your sites. (2) If something happens to require a complete reinstall, the passwords are all lost and you have no clue what they were. (3) I think the safest place to store them is in your head.
FOX NEWS.com should be BANNED from television and internet. Have the Congress take it over and give us Truespeak.
How exactly is Chrome (which is backed by a major company) a major browser?
"The majority is always sane, Louis." -- Nessus
http://slashdot.jp
http://www.bash.org/?244321
I don't need to go there. I know the answer is "hunter2" (if you're the guy, I just copy-pasted the ***s from bash.org, that's why it shows up as hunter2 on your screen).
Is that a sign I should get out more often? ;)
Comment removed based on user account deletion
Idiot-run newspapers are why bugmenot was invented.
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.