A security researcher has discovered that Microsoft Edge will load all your stored passwords into memory in plaintext at startup, making it easy for malware to scrape those passwords.
And yet you and most people use a door with a lock instead of something more secure because… in general they do work well for the purpose they’re trying to serve. Most criminals aren’t master criminals, and master criminals aren’t coming after your house.
Don’t overthink the metaphor. These things are fragile and fall apart. The “door with a lock” is the “guarantee” (wink wink) that the operating system won’t let programs see memory they shouldn’t be allowed to. Putting your valuables in a safe instead of sitting in the floor would be encrypting the passwords in memory in the metaphor.
Also, cyber security and physical security are very different. With cyber security you need to understand that there are orders of magnitude more people looking for simple problems. Like a criminal checking every door in the world automatically, just looking for ones that are unlocked. Someone not being a “target for master criminals” isn’t really applicable for this. Besides, that’s a critique of what level of security an individual should have, but pointing out the flaw in Edge is a critique of something that claims to be secure that isn’t.
I extracted IE6 passwords from hundreds of people when I was 13, for fun. If passwords are now being stored plaintext again, they are going to leak. Some of the people who steal those passwords won’t be doing it just for fun.
to be honest passwords on their own are on their way out as a form of security entirely for this reason - they’re inherently weak no matter how they’re stored as they’re a single point of failure. we’re even moving on from 2 factor to passkeys.
And yet you and most people use a door with a lock instead of something more secure because… in general they do work well for the purpose they’re trying to serve. Most criminals aren’t master criminals, and master criminals aren’t coming after your house.
Don’t overthink the metaphor. These things are fragile and fall apart. The “door with a lock” is the “guarantee” (wink wink) that the operating system won’t let programs see memory they shouldn’t be allowed to. Putting your valuables in a safe instead of sitting in the floor would be encrypting the passwords in memory in the metaphor.
Also, cyber security and physical security are very different. With cyber security you need to understand that there are orders of magnitude more people looking for simple problems. Like a criminal checking every door in the world automatically, just looking for ones that are unlocked. Someone not being a “target for master criminals” isn’t really applicable for this. Besides, that’s a critique of what level of security an individual should have, but pointing out the flaw in Edge is a critique of something that claims to be secure that isn’t.
fair
I extracted IE6 passwords from hundreds of people when I was 13, for fun. If passwords are now being stored plaintext again, they are going to leak. Some of the people who steal those passwords won’t be doing it just for fun.
to be honest passwords on their own are on their way out as a form of security entirely for this reason - they’re inherently weak no matter how they’re stored as they’re a single point of failure. we’re even moving on from 2 factor to passkeys.