Extensions Can Steal Plaintext Passwords

Does it mean saved passwords (in Edge/Chrome) are not in a safe place?

atinfo said:

Chrome extensions can steal plaintext passwords from websites

A team of researchers from the University of Wisconsin-Madison has uploaded to the Chrome Web Store a proof-of-concept extension that can steal plaintext passwords from a website's source code.

www.bleepingcomputer.com

Does it mean saved passwords (in Edge/Chrome) are not in a safe place?

Click to expand...

The "saved passwords" (in the browser), are OK. The article says that the extensions can grab passwords from "websites" that store passwords as plaintext.

Actually the article doesn't mention saved passwords in the browser at all. It's only referring to websites that store passwords as plain text. It doesn't say how the browser stores the passwords.

I guess the safest option would be to not run any extensions, until they get this worked out.

Saved Passwords in Edge are encrypted, if you want to export your saved passwords to a file for backup purposes you will be warned that the export will be plain text if you proceed.

Ghot said:

The "saved passwords" (in the browser), are OK

Click to expand...

DigitalGoat said:

Saved Passwords in Edge are encrypted

Click to expand...

Sorry but at least one readily available tool can retrieve all passwords from Edge in plain text even if they are protected by the 'primary password' facility.
It failed in its attempts to do the same with Firefox passwords protected by its 'primary password' facility. I have yet to find a tool that can work with Firefox but I would not be at all surprised to discover that one exists.


Denis

Ghot said:

Actually the article doesn't mention saved passwords in the browser at all. It's only referring to websites that store passwords as plain text. It doesn't say how the browser stores the passwords.

Click to expand...

Thanks . I thought that if users enter their password in the sign-in box (like Gmail), it would be revealed as plain text for extensions!

Ghot said:

The "saved passwords" (in the browser), are OK. The article says that the extensions can grab passwords from "websites" that store passwords as plaintext.

Click to expand...

As far as I can remember, FF had an extension (there was also an app) which could grab all saved passwords! I am sure the passwords (saved passwords in Edge/Chrome) are easily accessible, even for cookies!

Ghot said:

I guess the safest option would be to not run any extensions, until they get this worked out.

Click to expand...

I banned some of the extensions access to all URLs I visit (they will enable just for specific URLs). I'm wondering, why MS/Google doesn't implement permission access (like Android apps) options for extensions. An extension has to show what permission they have, and users should have a choice to let them access storage, passwords, and all URLs or not.

I'm just "guessing" what the article means.
I don't use any extensions in Firefox. And I don't use any other browser.

So no-thanks.