Slashdot Mirror
Google Releases Chrome 6, Pays $4337 In Bounties
Trailrunner7 writes "Google has released a new version of its Chrome browser and has included more than a dozen security fixes in the update. The new version, 6.0.472.53, was released two years to the day after the company pushed out the first version of Chrome. Google Chrome 6 includes patches for 14 total security vulnerabilities, including six high-priority flaws, and the company paid out a total of $4,337 in bug bounties to researchers who reported the vulnerabilities. A number of the flaws that didn't qualify for bug bounties were discovered by members of Google's internal security team." (Read on for more, below.)
Also on the Chrome front, morsch writes "Chrome 7 for Linux is planned to tie in with the Gnome Keyring and the KDE Wallet to securely store saved browser passwords. Users of the stable version of Google's Webkit-based browser might be surprised to find out that, so far, passwords are stored on the hard disk as clear text. On Windows, Chrome has always used a platform-specific crypto API call for encrypted storage. The corresponding Linux function was never implemented — until now. Unstable versions of Chrome 7 still disable the feature by default; it can be enabled using a parameter."
I'm not quite sure America has its value system on straight. Hit the right spaces on the Wheel of Fortune and solve two or more puzzles, and you could win $1,000,000. Answer 15 multiple choice trivia questions in the hotseat in front of Regis Philbin, wait, what it's now 12 questions in the new season walking around the stage with Meridith Vieira? Still $1,000,000. Ken Jennings is extremely smart, but he took Jeopardy! for multiple millions. Discover a flaw in Internet Explorer or Windows or just go after somebody else's research and count on the unpatched systems being still online... and you just got the ability to run a botnet if you're evil. Untold riches there. Discover flaws in Google's Chrome... and you get paid. But the entire panel of winners gets less than $5,000 for their trouble... Something's not right in the equity here.
Google's honoring a password security effort in Linux, and at least calling a cyrpto function in Windows... but why no support for the OSX Keyring?
$ 4337 in bounties? So thats one real hard bug $ l337 and $ 3000 worth of bugs that the skript-kiddies could have got.
Someone should fudge that 4 to be a 1 =P
Does Chrome 6 have print preview? Can you open files with helper applications without having to delete them manually later? Do Flash videos play the audio correctly?
What a fool believes, he sees, no wise man has the power to reason away.
Users of the stable version of Google's Webkit-based browser might be surprised to find out that, so far, passwords are stored on the hard disk as clear text.
I see. So that's why I keep my passwords stored in my head. No virus that can live in my head can read my passwords out of there, AFAIK.
Let q be a radix > 1. I am in ur base-q, killing 10 d00ds.
Just seeing how much money they paid out makes me scream...
AEET! AEET! AEET!
I just looked at the article briefly, and it states "A second high-priority flaw, a sandbox parameter deserialization error, was discovered by two members of Adobe's Reader Sandbox Team." What the--Adobe has a security team? That's crazy talk!
How does this goggle company plan to stay solvent throwing money around like this? Don't they know we are in a recession?
Any reasion for the version-number bloat? I mean, I guess it looks a bit cooler next to IE 8, but I don't really think people are that naive.
R.Mo
Comment removed based on user account deletion
It's nice that they're paying but if that's $4337/14 = roughly $310 per bug you'll just have to forgive me if I don't quit my day job to focus on debugging Chrome.
These posts express my own personal views, not those of my employer
Google better watch out or it'll go BUST with a bounty such as this !! WooHoo !! Get cracking !! But then the mob pays that every day. Which shall I go with ??
(
}
{
|
KNEEL !!
I went from Netscape to Firefox to Opera to Chrome, without ever stopping at Internet Explorer (except at work, where it is the default).
I have to say, though, that I've removed everything but Chrome (and the ubiquitous and hard to remove IE8) from my home computer. It really is an excellent browser.
You could also use Keepass. Not as safe as your head, but can store more than a few passwords.
So you removed them all but Google. You're saying to yourself, if google reads my mail, and stores my searches, and takes pictures of where I live, do I feel like I can use their browser? You trust Google knowing this ?? YYu are one fucking idiot !!
That's 0.0.082.78 per day!
No virus that can live in my head can read my passwords out of there, A.F.A.I.K.
(emphasis mine)
Now THAT's an open mind!
*ducks*
First thing I thought when I saw 4337 was "What the fuck is Aeet?"
That butt-face dude makes 5 grand an appearance, just for showing up. He looks stupid. Must be to only get 5 grand.
Paris
Because I am the whore you always wanted
FYI your linux logins on Ubuntu are stored in this file: /home/username/.config/google-chrome/Default/Login\ Data
just do "strings Login\ Data"
and you have those passwords. :(
Once it works with Murrine-ARGB and the Ubuntu appmenu bar, i don't see anything to pull me back to Epiphany again. It'll be just as native, and three orders of magnitude more performant on JS.
I've just confirmed the above, and it's the same on other Linux distros, not only on Ubuntu.
I hope this is some dreadful oversight! An application of Chrome's stature cannot be storing passwords in the clear by design, surely ...
As a Linux application developer who has used keyring/kwallet for saving secure passwords in the past. I'd recommend not to use them.
Various different distributions have different versions of the these utilities and their libraries. There are so many variations that it becomes hard to support all versions. Most desktop linux end users have never used them and when they see a warning window popping up (which these utilities tend to show). They cancel the window rather than going through the authentication process.
Just my 2 cents.
You're on Linux, the most trusted, secured and freshest OS in the universe !!
Why do you care if Google leaves your creds in the clear? If someone can read them, you are already OWNED !!
Yours,
Shirley, the one and only Summer's Eve girl
When integrating your plugin with someone else's application and you run into a bug in the parent app, you have 2 options
http://marusya-serial.ru/
What's your point?
If you ask browser to remember passwords, they will be stored somewhere in plain text or in some form that can be decrypted. Browser has no way to remember passwords without saving them somewhere. If passwords were stored on Google servers, then it would be an issue.
like a mirror,
only not really,
unless you shine it up,
you can see yourself in it.
You could also use Keepass.
Really bad name for a program meant to keep something.
> Do Flash videos play the audio correctly?
// ==UserScript==
// @name YouTubeWMP
// @version 1.0
// @description Replaces Flash player with WMP in YouTube.
// @run-at document-start
// @include http://www.youtube.com/*
// ==/UserScript==
Yes. The video on the other hand, as in all browsers, is a different story. We're still waiting for the fix from Adobe. In the meantime, you can use the following user script:
----(start of file)----
flp=document.getElementById("movie_player");
flp.outerHTML = "<EMBED type='application/x-mplayer2' width='" + flp.width + "' height='" + flp.height + "' src='" + unescape(flp.getAttribute("flashvars").match(/&fmt_url_map=[^&]*%7C([^&]*)/)[1]) + "' autostart='true' autosize='-1'></EMBED>";
----(end of file)----
This script is for YouTube, you can make similar ones for other sites easily. Just use the resources panel in the developer tools to figure out where to get the link to the flv stream.
> AFAIK
What about rootkits?
Some kind of encryption as obfuscation, DRM-style, is still better than just plain text. One of the tricks used by people who steal hard drives is to try every possible chain of subsequent bits as a password. It's only at most a few trillion tries (less than brute-forcing an 8-char alphanumeric password, and quite feasible with a botnet or a few days of time), and often as few as a few billion, but it gets passwords right quite often. Encryption would defeat this attack.
At least the Linux version for x86_64.
Try it
Maybe Computers will never be as intelligent as Humans.
For sure they won't ever become so stupid. [VR-1988]
>>"Chrome 7 for Linux is planned to tie in with the Gnome Keyring and the KDE Wallet <<
There is one piece of bloat i remove every single time on any install it is the incredulous crass invasion that is the KDE Wallet system it should be a if you want it go looking for it and tick the box thing NOT an install by default ,
These central pass word depositories are not a good idea sorry devs but the idea SUCKS so big it is almost untrue
What the F*** is Kharma i do got teeth i don't got no kharma
There is no universal ISO IEEE Regulatory standard for software version numbers, it's meaningless to compare them. Personally I mostly ignore them and look at the release or file date.
If you don't risk failure you don't risk success.
It does not defeat anything. Decryption password is stored in same location as encrypted data.
So that when someone steals your laptop they don't get access to your passwords/CC numbers? The only security that Firefox's master password provides that Chrome doesn't is if you happen to leave your computer logged in, unlocked and unattended but just happen not to have entered your master password into Firefox yet.
Firefox, on the other hand uses a password that protects them either when you try to view the passwords through the dialog box, OR when the passwords have to get loaded in order to be used by a site.
Not by default it doesn't - "Use a master password" is unchecked by default, meaning very few people are actually protected by it.
I see. So that's why I keep my passwords stored in my head. No virus that can live in my head can read my passwords out of there, AFAIK.
No, dude! That's what they want you to think!!! Quick, forget all your passwords and go stand next to somebody that's thinking about windows xp...
>I see. So that's why I keep my passwords stored in my head. No virus that can live in my head can read my passwords out of there, AFAIK.
In other news Hacker Geneticists start breeding Meningitus that can talk...
Unicode killed the ASCII-art *
I have been using 6 Beta for two months because of the instabilities of version 5.x. Typing something in the location bar was often enough to crash the browser. Chrome is not complete or flexible as the the other browsers on the market but for sure is the faster. This only thing makes me to prefer chrome over the others.
It's a pretty big showstopper for me, since it makes using it at work extremely difficult to do. I do wish it had its own proxy engine like Firefox does.
A password that only lives in your head is of little use. Sooner or later you'll have to use it somewhere, and a virus can easily read it from the keyboard buffer / form field. Maybe it's even more likely it reads the password from a form than from where it's stored at the disk. While there are A LOT of ways to store passwords on disk, it's pretty limited in the ways you can use them.
It's The Golden Rule: "He who has the gold makes the rules."
Firefox can optionally use a master password to encrypt the other stored passwords. You have to enter the master password once per session (or, if you prefer, every time you access the store). This doesn't prevent a determined attacker who has root from getting those passwords (he could use a keylogger to get the master password, etc.). But it does mean that sheer physical access is not enough, so if someone copies your Firefox profile, or restores it from an old HD, the passwords still would need to be decrypted. If I understand correctly, using the Gnome login keychain is just as safe as the Firefox master password, it's stored in an encrypted fashion and decrypted at login (using the user's password, I guess?).
Switch back to Slashdot's D1 system.
The decryption password isn't stored anywhere. You have to remember it. But remembering one password beats remembering 10, 20 or 100.
Switch back to Slashdot's D1 system.
The password-required feature is logging in to your user account. Chrome uses the Windows encryption facility that piggybacks off of Windows user logins.
Not really, it's not. It gives a false sense of security when in reality the password is going to be easily retrieved from disk by a hacker. The only way to properly secure passwords is with another password, and proper encryption that uses this password somehow to derive its key. See: http://developer.pidgin.im/wiki/PlainTextPasswords
Yup. If the browser can decrypt them, so can a virus.* But it is well-known that most people suck at remembering passwords and the security risk of choosing bad passwords is worse in most cases than that of the browser remembering them. And if the browser doesn't remember them, people *will* use easy to guess passwords, and are economically justified in doing so.
* Note: you can make the area where passwords are stored privileged so that the kernel can decide to only let the browser in. For this to work reasonably well, you'd also have to make sure that viruses can't infect the browser. It's possible, but neither Windows nor Linux do this, although I gather that the Mac does. But it doesn't run the software I want to use on the computer I want to use, so yeah.
It uses Keychain on OS X AFAIK, and there's a 1Password plugin for it so you can use that as well.
Try using http://lastpass.com/ for Chrome passwords - it encrypts the passwords on disk (of course), has a lot more features, and is a cross-browser plugin for Firefox, IE, Safari as well as Chrome, on Windows/Mac/Linux etc. It also has paid-for versions for iPhone, Android, etc, and syncs the passwords to the cloud.
You could also use Keepass. Not as safe as your head, but can store more than a few passwords.
this
I use keepass and dropbox to sync the keepass database between my most used computers. The downside is that I can't access stuff i don't remember when i'm not at one of those computers. Before keepass i just used 3 or 4 different passwords for every site.
If you ask browser to remember passwords, they will be stored somewhere in plain text or in some form that can be decrypted.
It's called a password-protected, encrypted keychain, and it's hardly new technology.
It's nice to see the broader technical community getting recognition from Google as.... ...bringin' the HEET
It uses the Keyring on OSX which is secure AFAICT
It was inspired by Pulp Fiction.
To see the passwords you need to enter the master password again, else the passwords can be used, but not revealed, so as soon as firefox is closed/crashes the passwords will be useless..
You dummorz can't even R33d???
be posting a bug bounty for bugs of other browsers?
Last time I've checked IE and Mozilla does not require any password to be set to remember passwords. Mozilla does have master password, but the only time I was confronted with it was when I didn't use it and lost all my IceDove passwords during upgrade. Konqueror can use Kwallet, but it is most annoying thing in KDE.
Not sure what your point is. The master password function in Firefox is optional. If you don't use it, you don't have to remember a password. If you do use it, you do have to remember a password, since obviously Firefox doesn't store it anywhere.
Switch back to Slashdot's D1 system.