An unskilled attacker with no knowledge won't know where to go to get the passwords.
An unskilled attacker with instructions can type in a url to get a password dumper, and be in and out in 30 seconds plus memorization/transcription time.
An unskilled attacker with instructions can type in a url to get a password dumper, and be in and out in 30 seconds plus memorization/transcription time.
Locks on your front door knob are not there to keep out burglars. They're there to prevent opportunistic crime: someone who tries that doorknob out of curiosity and discovers a home full of stuff and no one around. There's a large middle ground between good guys, bad guys, and those who might, just might, be tempted to be bad when they find that suitcase full of money. That's what Google is missing here.
And in a condescending response[1], someone who is allegedly the Google head of Chrome security called the original author a "novice", claimed Google has "quite a bit of data" to back up their case (without describing the data, its source, or how it was evaluated), and suggested that a master password would make security worse by providing a false sense of security.
First, I would suggest that if Google really does have the data mentioned in the claim, release it. Second, a master password isn't going to make the computer safer from a determined black hat because physical access to the machine means game over, but THE MASTER PASSWORD IS NOT ABOUT PROTECTION FROM BLACK HATS.
When the colleague who hates you is standing by your unlocked computer when you're off to get coffee and suddenly realizes that he not only can read your email now, but at any time he wants to in the future, that's a problem — when your partner gets suspicious about your working long and you've forgotten to log out — when your little brother realizes he can post "funny" pictures to your Facebook page ... when, when, when ... there are so many areas where this could cause a lot of pain. For example, this is from a blog entry I wrote a decade ago about a young lady who was compromised because LiveJournal stored her username in the cookie and the conservative, religious parents found her blog[2]:
I know of a young lady who kept an online journal. Her
parents found it and started reading it and were
horrified to find out that she was suffering from --
brace yourself -- teen angst! Her parents don't
understand her, not enough boys like her, she's not very
popular, etc., etc. In reading through the journal,
there are no references to doing drugs, sex, or anything
else that one might expect a parent to worry about, but
this young lady's parents hit the roof. They forbid her
to keep an online journal and they grounded her
(naturally, I'm sure this cured the angst problem).
Google is optimizing against black hats but pretending that opportunistic crime doesn't exist. In physical security, opportunistic criminals tend not to be the brightest or think too deeply about what they're doing, but when the opportunity is there, they go for. Google is happy to give them that opportunity.
1. https://news.ycombinator.com/item?id=6166953
2. http://use.perl.org/use.perl.org/_Ovid/journal/13471.html
But I could just as easily conceive of an attacker who knows how to read a computer screen but doesn't know how to use basic window management, and thus conclude that the browser window should always display all saved passwords as long as the user can minimize the browser.
Or toward the other end of the continuum, I could conceive of an attacker who knows how to install a keylogger but doesn't know how to lift and spoof fingerprints, and thus conclude that the browser should require a fingerprint scanner to recall saved passwords.
These arguments need to establish why the line should be drawn in that specific spot, rather than just mentioning the line and describing the types of attacks it can thwart.
Oh come on, writing a bookmarklet is not a fair comparison. A fair comparison is the little brother googling 'chrome passwords' and finding a link to chromereveal.com[1] That's a more interesting activity than wandering around settings.
Download: Less than five seconds
Run: If it's a custom tool, less than five seconds to have passwords displayed
Delete: click the 'remove' button on the downloads list, less then five seconds
In terms of bike locks, this is one you can take off with a pen and no previous practice.
And by the way, you also forgot deleting the dumper site from the browser's history, (and DNS/proxy records if they're being logged) using a system password to install the software if the system has that kind of security, and so on. But I digress, the point is not that a master password will keep a determined or informed interloper out, it is that it will "keep an honest person honest."
No. I'm still a bit undecided on whether a safeguard would be worth adding or not. What I'm arguing is that many of the people making points in favor of a safeguard are doing so on weak reasoning, where they overestimate the effectiveness of it against a casual, untrained attacker. No foreknowledge is needed to make a search, and if you find instructions then I very strongly disagree that running a program is harder than navigating settings.
> deleting the dumper site from the browser's history, (and DNS/proxy records if they're being logged) using a system password to install the software if the system has that kind of security
Oh come on. This is supposed to be a casual situation where you let someone use your computer. What kind of history-monitored remote-logging computer is going to have saved passwords and unauthorized access in the first place?
> keep an honest person honest
You already have to enter a page solely for editing passwords and hit specific show buttons per password. There is zero plausible deniability at this point. I think an 'honest' person will already be kept out, and any changes would only matter in marginal situations.
So what exactly is the harm or downside? Firefox has it. Neither Safari or IE display passwords in this manner either.
>No foreknowledge is needed to make a search, and if you find instructions then I very strongly disagree that running a program is harder than navigating settings.
Making a search is how you would acquire the foreknowledge. I was talking about an unskilled user acting in moment of opportunity - not someone who has researched password cracking and has unfettered access. I would bet that an employer, or an IT department, or a jury would see a difference between downloading & installing software on a machine and just opening the settings on it.
>Oh come on. This is supposed to be a casual situation where you let someone use your computer. What kind of history-monitored remote-logging computer is going to have saved passwords and unauthorized access in the first place?
Look, this could be in the workplace when someone gets up from their desk to go to the bathroom or get a cup of coffee. Chrome is on every platform. Some systems require administrative privilege (and a system password) to install new software but none is required to open chrome and veiw settings. I use a DNS service at home to watch what sites my kids use. I would know (albeit after the fact) if they downloaded a pw dumper. Lots of companies use firewalls and the like too. I was speaking about covering one's tracks - in any setting not just the kind you imagine.
>> keep an honest person honest
It is a reference to an old locksmith saying, specifically: "Locks are on doors only to keep honest people honest."