Extensions Can Steal Plaintext Passwords

atinfo · Sep 8, 2023

Chrome extensions can steal plaintext passwords from websites

A team of researchers from the University of Wisconsin-Madison has uploaded to the Chrome Web Store a proof-of-concept extension that can steal plaintext passwords from a website's source code.

www.bleepingcomputer.com

Does it mean saved passwords (in Edge/Chrome) are not in a safe place?

Ghot · Sep 8, 2023

atinfo said:
Chrome extensions can steal plaintext passwords from websites

A team of researchers from the University of Wisconsin-Madison has uploaded to the Chrome Web Store a proof-of-concept extension that can steal plaintext passwords from a website's source code.

www.bleepingcomputer.com

Does it mean saved passwords (in Edge/Chrome) are not in a safe place?

The "saved passwords" (in the browser), are OK. The article says that the extensions can grab passwords from "websites" that store passwords as plaintext.

Actually the article doesn't mention saved passwords in the browser at all. It's only referring to websites that store passwords as plain text. It doesn't say how the browser stores the passwords.

I guess the safest option would be to not run any extensions, until they get this worked out.

DigitalGoat · Sep 8, 2023

Saved Passwords in Edge are encrypted, if you want to export your saved passwords to a file for backup purposes you will be warned that the export will be plain text if you proceed.

Try3 · Sep 8, 2023

Ghot said:
The "saved passwords" (in the browser), are OK

DigitalGoat said:
Saved Passwords in Edge are encrypted

Sorry but at least one readily available tool can retrieve all passwords from Edge in plain text even if they are protected by the 'primary password' facility.
It failed in its attempts to do the same with Firefox passwords protected by its 'primary password' facility. I have yet to find a tool that can work with Firefox but I would not be at all surprised to discover that one exists.

Denis

atinfo · Sep 8, 2023

Ghot said:
Actually the article doesn't mention saved passwords in the browser at all. It's only referring to websites that store passwords as plain text. It doesn't say how the browser stores the passwords.

Thanks

. I thought that if users enter their password in the sign-in box (like Gmail), it would be revealed as plain text for extensions!

Ghot said:
The "saved passwords" (in the browser), are OK. The article says that the extensions can grab passwords from "websites" that store passwords as plaintext.

As far as I can remember, FF had an extension (there was also an app) which could grab all saved passwords! I am sure the passwords (saved passwords in Edge/Chrome) are easily accessible, even for cookies!

Ghot said:
I guess the safest option would be to not run any extensions, until they get this worked out.

I banned some of the extensions access to all URLs I visit (they will enable just for specific URLs). I'm wondering, why MS/Google doesn't implement permission access (like Android apps) options for extensions. An extension has to show what permission they have, and users should have a choice to let them access storage, passwords, and all URLs or not.