Browsers asking computer authentication to reveal saved passwords is useless

So as you know, many browsers ask you to type in your computer password or other authentication method in order to reveal the said saved password. Does anyone know why this feature even exists? It is completly useless.

To illustrate how it is useless I have put up a test login with my username "user" and password "password".

Here is what it looks like when I select the autofill for instance:


And all I have to do is open inspect element, select the password tab and change type="password" into type="text"

And when I change the type from password to text, my password is displayed without any authentication, can someone explain why this feature exists if it does not seem to really protect my password?

You said "useless" but what you seem to be worried about is that it is insecure.

Many browsers require use of an overarching 'Primary password' to stop passwords being extracted in plain text to everyone.
When I recently tested Edge, I found that online tools could easily extract passwords despite the existence of a 'Primary password'.
I've seen several posts that say that all browser security can be cracked and that the only safe method is use of a specialist Password manager. If you search ElevenForum & TenForums you'll find suggestions about which are the better Password managers.


Denis

are you asking what good are the hashes for? If so, they’re to stop people who look over your shoulder from seeing your password.
You can change whatever you like in that element, it’s still only visible to you. How does this affect you? I’m not sure what you mean?

Edit.
I am such a slow typer.

But you have it turned on

Google password manager > Settings > turn off 'Use Windows Hello when filling passwords'

Not the first time a feature like this made the “Default ON” list..

Re-Opening your browser on a reboot to the last page you had opened let scammers run wild on Windows for years, and Google left that one on too..

They don’t always make the best decisions..

BobOmb said:

Google password manager > Settings > turn off 'Use Windows Hello when filling passwords'

Click to expand...

Locking down autofill prevents password stealers from grabbing your passwords easily.

TairikuOkami said:

Locking down autofill prevents password stealers from grabbing your passwords easily.

Click to expand...

I'm pretty sure he just demonstrated how to defeat it easily, load any page in the list then text replace the html and save the output... I mean thats the OP, a short script should be able to handle that..

I totally agree with @Try3. From a security standpoint, disabling "ask to save passwords" in browsers and using a password manager is the only way to go. One should make the master password that accesses any password manager VERY difficult. But all password managers are not equal.

glasskuter said:

I totally agree with @Try3. From a security standpoint, disabling "ask to save passwords" in browsers and using a password manager is the only way to go. One should make the master password that accesses any password manager VERY difficult. But all password managers are not equal.

Which is your preferred password manager software? 2nd Edition. New and improved

After some very valid criticism of the previous poll, I have decided to try again. I have just re-read every post in the old thread and noted all the password managers mentioned in the comments. As I can only have ten possible responses I don't want "Other" or "None of the above" I have also...

www.elevenforum.com

Click to expand...

No one can hack a piece of paper. Passwords I care about are the one thing I do not store inside the computer.

BobOmb said:

No one can hack a piece of paper.

Click to expand...

I would wager that some of the passwords you have on that paper are simple enough that hacking software could break them in less than 10 minutes. I would also bet that your piece of paper is kept within close proximity to your computer. There are some here that still do it the paper way but if you do, at least take extra precautions.

glasskuter said:

I would wager that some of the passwords you have on that paper are simple enough that hacking software could break them in less than 10 minutes.

Click to expand...

If someone is hacking your account with brute force your password means nothing to begin with

But, noted…

If you’re going through all the trouble of using a password manager and end up writng it down instead, you could just do something creative like reversing JohnDoe to DoeJohn and knowing its reversed… And noone else but you would ever know.. We’ve moved into this overcomplicated area with passwords IMHO..

And to the OP’s point if you are gonna save anything into the machine, its probably accessible..

@glasskuter Which password manager do you use?

I've been a Roboform user for over 10 years, Gary.

BobOmb said:

But you have it turned on

Google password manager > Settings > turn off 'Use Windows Hello when filling passwords'

Not the first time a feature like this made the “Default ON” list..

Re-Opening your browser on a reboot to the last page you had opened let scammers run wild on Windows for years, and Google left that one on too..

They don’t always make the best decisions..

Click to expand...

Thanks for letting me know about that setting. I was just curious as to what this setting exactly protects. If it protects rats that steal your passwords then to my knowladge, they can still steal your passwords regardless of that setting. So that is why I was confused.

BobOmb said:

I'm pretty sure he just demonstrated how to defeat it easily, load any page in the list then text replace the html and save the output...

Click to expand...

No, that was after user's autofill or an automatic autofill, which is equally bad. Any password manager, which supports it, is bad.

TairikuOkami said:

Any password manager, which supports it, is bad.

Click to expand...

I have to disagree regarding Windows Hello. If one uses a pin, then Yes, using Windows Hello to access a password manager is definitely not a good idea. But if one uses biometrics, using Windows Hello, facial recognition or fingerprint with his password manager is way more secure and is even safer than entering a master password as it safely gets past even keyloggers.