New issue
Advanced search Search tips

Issue 781675 link

Starred by 1 user
Status: Duplicate
Merged: issue 126398
Owner: ----
Closed: Nov 2017
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 2
Type: Bug-Security



Sign in to add a comment

Local attacker can get details of saved passwords

Reported by ram.puru...@gmail.com, Nov 6 2017 
UserAgent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.110 Safari/537.36

Steps to reproduce the problem:
1. Total length of all the password should be encrypted and saved 
2. saved password can be viewed by changing the field type to text
3. Length of the character of the password should be fixed for all the password as same as it can be guessed by the character length  

What is the expected behavior?

What went wrong?
saved password shouldn't be viewed by changing the password field to 'text' in the developer mode or option.

The length of the password should be same in the saved password in setting 

Did this work before? No 

Chrome version: 57.0.2987.110  Channel: n/a
OS Version: 10.0
Flash Version: 

This might improve the password security in the browser so that no on can guess or see the save password in the common system.
Screenshot (2).png
168 KB View Download

Comment 1 by elawrence@chromium.org, Nov 6 2017

Mergedinto: 126398
Status: Duplicate (was: Unconfirmed)
Summary: Local attacker can get details of saved passwords (was: Saved password detail)
An attacker with physical access to your system can already conduct all manner of attacks [1].

Unmasking of the password using Developer Tools [2] is just one of many.

[1] https://chromium.googlesource.com/chromium/src/+/master/docs/security/faq.md#Why-arent-physically_local-attacks-in-Chromes-threat-model

[2] https://chromium.googlesource.com/chromium/src/+/master/docs/security/faq.md#What-about-unmasking-of-passwords-with-the-developer-tools
Project Member

Comment 2 by sheriffbot@chromium.org, Feb 13 2018

Labels: -Restrict-View-SecurityTeam allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Comment 3 by elawrence@chromium.org, Feb 14 2018 

 Issue 812159  has been merged into this issue.
►

Sign in to add a comment