Skip to content
  • Holy shit, Microsoft.

    World infosec facepalm clowncar
    27
    0 Votes
    27 Posts
    0 Views
    David Chisnall (*Now with 50% more sarcasm!*)D
    @kaidenshi @KF0UNK Not really.Edge: The passwords are in memory, an attacker who can dump memory can read them.Chrome: The passwords are encrypted, but the decryption key is in memory. An attacker who can dump memory can read the decryption key and read them.Both models are vulnerable to the exact same set of attacker capabilities. From a threat-model perspective, they are not different. If your threat model is ‘administrators on the system must not see my passwords’ then you have problems that cannot be solved on conventional operating systems on conventional hardware.