Browsers asking computer authentication to reveal saved passwords is useless

VentsDragon · Sep 9, 2023

So as you know, many browsers ask you to type in your computer password or other authentication method in order to reveal the said saved password. Does anyone know why this feature even exists? It is completly useless.

To illustrate how it is useless I have put up a test login with my username "user" and password "password".

Here is what it looks like when I select the autofill for instance:

And all I have to do is open inspect element, select the password tab and change type="password" into type="text"

And when I change the type from password to text, my password is displayed without any authentication, can someone explain why this feature exists if it does not seem to really protect my password?

Try3 · Sep 9, 2023

You said "useless" but what you seem to be worried about is that it is insecure.

Many browsers require use of an overarching 'Primary password' to stop passwords being extracted in plain text to everyone.
When I recently tested Edge, I found that online tools could easily extract passwords despite the existence of a 'Primary password'.
I've seen several posts that say that all browser security can be cracked and that the only safe method is use of a specialist Password manager. If you search ElevenForum & TenForums you'll find suggestions about which are the better Password managers.

Denis

antspants · Sep 9, 2023

are you asking what good are the hashes for? If so, they’re to stop people who look over your shoulder from seeing your password.
You can change whatever you like in that element, it’s still only visible to you. How does this affect you? I’m not sure what you mean?

Edit.
I am such a slow typer.

BobOmb · Sep 9, 2023

But you have it turned on

Google password manager > Settings > turn off 'Use Windows Hello when filling passwords'

Not the first time a feature like this made the “Default ON” list..

Re-Opening your browser on a reboot to the last page you had opened let scammers run wild on Windows for years, and Google left that one on too..

They don’t always make the best decisions..

TairikuOkami · Sep 9, 2023

BobOmb said:
Google password manager > Settings > turn off 'Use Windows Hello when filling passwords'

Locking down autofill prevents password stealers from grabbing your passwords easily.

BobOmb · Sep 9, 2023

TairikuOkami said:
Locking down autofill prevents password stealers from grabbing your passwords easily.

I'm pretty sure he just demonstrated how to defeat it easily, load any page in the list then text replace the html and save the output... I mean thats the OP, a short script should be able to handle that..

glasskuter · Sep 9, 2023

I totally agree with @Try3. From a security standpoint, disabling "ask to save passwords" in browsers and using a password manager is the only way to go. One should make the master password that accesses any password manager VERY difficult. But all password managers are not equal.

Which is your preferred password manager software? 2nd Edition. New and improved

After some very valid criticism of the previous poll, I have decided to try again. I have just re-read every post in the old thread and noted all the password managers mentioned in the comments. As I can only have ten possible responses I don't want "Other" or "None of the above" I have also...

www.elevenforum.com

BobOmb · Sep 9, 2023

glasskuter said:
I totally agree with @Try3. From a security standpoint, disabling "ask to save passwords" in browsers and using a password manager is the only way to go. One should make the master password that accesses any password manager VERY difficult. But all password managers are not equal.

Which is your preferred password manager software? 2nd Edition. New and improved

After some very valid criticism of the previous poll, I have decided to try again. I have just re-read every post in the old thread and noted all the password managers mentioned in the comments. As I can only have ten possible responses I don't want "Other" or "None of the above" I have also...

www.elevenforum.com

No one can hack a piece of paper. Passwords I care about are the one thing I do not store inside the computer.

glasskuter · Sep 9, 2023

BobOmb said:
No one can hack a piece of paper.

I would wager that some of the passwords you have on that paper are simple enough that hacking software could break them in less than 10 minutes. I would also bet that your piece of paper is kept within close proximity to your computer. There are some here that still do it the paper way but if you do, at least take extra precautions.

BobOmb · Sep 9, 2023

glasskuter said:
I would wager that some of the passwords you have on that paper are simple enough that hacking software could break them in less than 10 minutes.

If someone is hacking your account with brute force your password means nothing to begin with

But, noted…

If you’re going through all the trouble of using a password manager and end up writng it down instead, you could just do something creative like reversing JohnDoe to DoeJohn and knowing its reversed… And noone else but you would ever know.. We’ve moved into this overcomplicated area with passwords IMHO..

And to the OP’s point if you are gonna save anything into the machine, its probably accessible..

glasskuter · Sep 9, 2023

Create and use strong passwords - Microsoft Support

Follow these tips to improve the safety and security of your online accounts by creating strong passwords and keeping them secure.

support.microsoft.com

TraderGary · Sep 9, 2023

@glasskuter Which password manager do you use?

glasskuter · Sep 9, 2023

I've been a Roboform user for over 10 years, Gary.

VentsDragon · Sep 9, 2023

BobOmb said:
But you have it turned on

Google password manager > Settings > turn off 'Use Windows Hello when filling passwords'

Not the first time a feature like this made the “Default ON” list..

Re-Opening your browser on a reboot to the last page you had opened let scammers run wild on Windows for years, and Google left that one on too..

They don’t always make the best decisions..

Thanks for letting me know about that setting. I was just curious as to what this setting exactly protects. If it protects rats that steal your passwords then to my knowladge, they can still steal your passwords regardless of that setting. So that is why I was confused.

TairikuOkami · Sep 9, 2023

BobOmb said:
I'm pretty sure he just demonstrated how to defeat it easily, load any page in the list then text replace the html and save the output...

No, that was after user's autofill or an automatic autofill, which is equally bad. Any password manager, which supports it, is bad.

glasskuter · Sep 9, 2023

TairikuOkami said:
Any password manager, which supports it, is bad.

I have to disagree regarding Windows Hello. If one uses a pin, then Yes, using Windows Hello to access a password manager is definitely not a good idea. But if one uses biometrics, using Windows Hello, facial recognition or fingerprint with his password manager is way more secure and is even safer than entering a master password as it safely gets past even keyloggers.

Browsers asking computer authentication to reveal saved passwords is useless

New member

My Computer

Well-known member

My Computer

Like a rolling drone.

My Computers

Well-known member

My Computer

Microsoft 365 Basic

My Computer

Well-known member

My Computer

aka Mama Glass

My Computers

Well-known member

My Computer

aka Mama Glass

My Computers

Well-known member

My Computer

aka Mama Glass

My Computers

Stock Market Wizard

My Computer

aka Mama Glass

My Computers

New member

My Computer

Microsoft 365 Basic

My Computer

aka Mama Glass

My Computers

Similar threads