Hacker News Reader

Comment by jrochkind1 | Hacker News Reader

Chrome OSX stores in OSX keychain, out of the box. Which is a fairly secure way to store passwords.

Let's assume for the sake of argument that we are running code on both a Windows machine and an OS X machine, and trying to steal someone's browser passwords.

While it is undeniable that the OSX keychain adds a roadblock to the theft, many average users would happily enter their password if the box was displayed when they ran up their browser (even if the browser wasn't the originating process) and likely also fall for a fake keychain prompt.

I think the keychain is a good thing (just as it is in Android). Just wanted to make the point that the keychain for your average non-power user is a minor roadblock in theft, rather than a "real" security feature.

Yes, but there is nothing that a program can do to prevent the user from hanging themselves. If an attacker has access to your hardware and user session then they can do almost anything, and at the OS level too.

At least Chrome extends the supplied OS security features and doesn't try to re-engineer them from scratch. This makes me more comfortable with Chrome rather than less.

You're mostly talking about what's basically a phishing attack, right?

I'm not really sure there is really any defense yet devised for phishing attacks against 'average non-power users.'

I'm not disputing you though, I think it is a problem. But unrelated to how securely a given app stores sensitive info, which is what OP is about.

The Linux version does the same with KWallet or the Gnome keychain, as long as you're using KDE or Gnome.

Gnome-keyring doesn't have many dependencies, so you can run it with any desktop environment or window manager. Recent versions of Xfce have built-in support for loading it at login. It also integrates nicely with GPG, SSH, and network-manager. I'm not sure about KWallet.

In essence, all the browsers do roughly that on all platforms the article mentions.

I don't think that's true.

Firefox, out of the box, does _not_ use the OSX keychain even on OSX. Sadly. It ought to.

Reply on news.ycombinator.com