Posted on 07/12/2021 11:30:18 AM PDT by ShadowAce
When some readers installed the new Microsoft Edge browser — which replaces the old “legacy Edge” — they got a big surprise. They discovered that Edge had somehow magically absorbed all the usernames and passwords they’d carefully saved in their previously installed browsers, such as Chrome, Firefox, Internet Explorer, and legacy Edge.
What’s even more surprising is that Edge — which until recently couldn’t import or export passwords at all — may be doing this new behavior by design.
The bad news is that you shouldn’t store passwords in Edge in the first place — or in any browser, really. This may allow other programs, including malware, to read passwords that are stored in machine-readable files. Please read on.
The password-vacuuming behavior described above occurred because of the following sequence of events, according to one reader:
Figure 1 shows the dialog box the reader photographed with his phone. This yes-no query might be named “May I import the passwords from Edge that you didn’t know Edge already had a copy of?”
Figure 1. When Edge was installed, it copied the passwords that had been stored by an existing instance of Firefox, a reader claims. When a new version of Firefox was installed without copying any passwords, it asked the user whether it should sign in to sites such as Social Security by importing login credentials from Edge. (I’ve highlighted Firefox’s request with an orange box.) Source: Screen shot from reader’s smartphone
Other users have reported a similar sequence of events involving Edge and Chrome browser. In August, one poster said on the official Microsoft Answers forum for Edge:
I have no idea how this happened, but after updating my computer, Microsoft Edge opens up, which is normal I suppose, but they got my Google Chrome passwords and bookmarks without my consent …
Moderators quickly responded that Edge importing Chrome’s stored passwords without user approval “wasn’t very likely.” Edge is supposed to present the dialog box shown in Figure 2, asking whether to import or not import.
Figure 2. When Edge is installed, it’s supposed to present the user with a dialog box asking whether it can import saved passwords from whichever browser the user had previously used the most. Source: Microsoft Answers page
The history of Edge’s and other browsers’ stored passwords is a bit hard to follow. As recently as June 2020, users complained that Edge had an “export passwords” function but no ability to import passwords from other browsers at all.
Much later, on April 21, 2021 — just three months ago — users began reporting in Microsoft Answers posts that Edge had gained an import feature, but only in a private Insider Channels build and then only if a special command line were entered.
A long article, updated by a Microsoft Ambassador, finally describes on July 2 all
the ins and outs of how Edge stores and manages passwords.
Separately, an undated and unsigned Microsoft support document explains the rules Edge follows when it decides whether to copy a previously installed browser’s saved passwords:
Whew! That’s a lot to take in. But you don’t need to remember all of the above. All you need to remember is that most browsers store your saved passwords in an unsecure way that malware can silently copy and send to a hacker’s server.
I urged my readers to establish a “master password” way back in a November 23, 2004, article, which remarkably is still online. Back then, the exciting new browser was Firefox 1.0. It was the only browser that allowed you to enter an overall string that would encrypt your saved passwords, protecting them from snoopy co-workers and hidden malware. IE certainly couldn’t protect you.
I can’t believe that almost 17 years later I still need to ask people to do this. Browsers should encrypt your saved passwords by default. But most don’t.
The German Federal Office for Information Security (BSI, in German) audited Edge 44, IE 11, Chrome 76, and Firefox 68 in September 2019. Firefox was the only browser that supported a master password. (Mozilla now calls this the “primary password.”) Chrome and Edge also lacked an option to block telemetry collection and provide organizational transparency.
As a result, BSI recommended that German agencies and businesses use only Firefox. For more information, see a ZDNet article and a Forbes summary.
As recently as April 9, 2021, a poster at the Microsoft Tech Community forum announced that a master-password feature had been spotted in a beta version of Edge. However, it’s only a “controlled feature,” meaning it’s not yet in wide distribution.
As of July 6, Microsoft’s official feature roadmap for Edge said: “Require authentication before auto-filling passwords.” The target date was given as April 2021, but the status of this feature was still described as “in development.”
I asked Microsoft officials how Edge handles saved passwords from other browsers. According to Microsoft, “Microsoft Edge does not directly pop-up or autofill data from other browsers. Instead, customers have the option to import their browsing data from other browsers to Microsoft Edge based on their interest and consent.”
Regarding reports that Edge had copied saved-password files from Chrome and Firefox without user approval, Microsoft’s statement said this: “The Edge password import feature is now enabled by default in all Microsoft Edge Channels. It can be found on the edge://settings/passwords page inside the Overflow Menu of the Saved Passwords table. Microsoft is looking into the reports you shared and monitoring feedback to improve customer password import experiences.”
There’s good news on whether Edge will soon allow users to enter a master password that would encrypt any username/password combinations that Edge saves. “Microsoft will offer this functionality closer to end of July. If you are on a shared device or have left your computer unlocked, you can opt to add a second verification using your device password to avoid others accessing your website credentials or auto-fill data.”
The statement added: “For more information on Microsoft Edge’s encryption method, please see this support doc: Microsoft Edge password manager security.”
When someone who really knows what Edge is doing with passwords becomes available, I’ll write more about it in this space.
That Microsoft support document states: “Microsoft security baselines recommend disabling the password manager.” The reason is that a computer worm that compromises a network of PCs could obtain all the passwords stored by every browser on the network.
For all the above reasons, I’m going to tell you now not to store passwords in browsers at all.
Despite the precautions browsers may take, your usernames and passwords are prime targets for hackers. Your stored credentials may include the keys to your bank account, your credit union, your credit cards, and more.
The Mitre Att&ck website lists in Document T1555.003 more than 70 attack vectors that are currently circulating to scrape your passwords out of whatever files various browsers store them in. The security group also lists numerous exploits that hack into the old Windows Credential Manager and even some password managers, such as KeePass.
Do you think your PC could never become silently infected by malware?
Don’t be so sure.
People who downloaded a completely legitimate, open-source video transcoder, HandBrake, learned only later that its server had been hacked. Installing the video app silently inserted OSX/Proton, a Trojan horse that was designed to infect Macs. The developer warned customers in a Web posting that half of all their downloads between May 2 and 6, 2017, had contained the malware, according to an Objective-See blog post.
More recently, viruses have emerged that constantly monitor the Windows Clipboard. This could lead to many nefarious acts, but the so-called Clipboard Wallet Hijacker watches for transactions that move digital currency from one of your wallets to another. If this occurs, the malware changes the destination from your crypto account to its own. The security firm 360 Total Security has detected this silent robber on more than 300,000 computers, according to a July 1 Laptop Mag article.
As a first step to protect yourself, you should turn off all of your browsers’ capabilities to store usernames and passwords. Then delete any credentials it stored. Edge has a simple check-box to do this if you select Settings, Profiles, Passwords, as I explained in my May 17 column.
There are many good password managers, but in that same column I noted that 1Password is the top choice of CNET, Wirecutter, Wired, and several other test sites. It’s not free, costing $3/month for a single user or $5/month for five people. But 1Password is worth it for its support of industry standards and two-factor authentication (2FA) using small USB fobs as well as the MS Authenticator and Authy mobile apps.
Password managers can help you enter passwords into apps that aren’t websites and don’t use a browser. For instance, you may have programs that connect you to sensitive services without there being any webpage to sign in on.
Until a better system than usernames and passwords catches on, we all need to secure these valuable little character strings as best we can.
ms is ending support of IE
if they can access it, can others who shouldn’t be able to?
Vandelay Industries. Vandelay Industries.
They say they ended support for Win7 but I seem to get a lot of updates.
security patches?
Just changed over to BitWarden from Lastpass. Had LastPass for 10 years. Bit warden is working much better.
Yep, NEVER store passwords in the browser. Just disable the ability to do it so that it never asks again.
Using a password manager has changed my life, just made dealing with the zillions of sites easier. Every different site I go to has a randomized 12 character password. Password reuse is common vector for breakins.
Windows ping.
 |  |
|---|
Thanks to upchuck and ShadowAce for the pings!
I’m wondering why ANYBODY would be surprised? The new MS Edge is a Chrome-based browser. You need to explicitly tell it not to import passwords and such, IIRC. And MS did not strip out the portions of Chrome that report home to Big Brother, either.
If you use a browser to keep your passwords you’re hopeless.
I use Dashlane and love it.
You only need to know one master password.
It interacts with all modern browsers and automates logging into a site (with your permission). It generates strong passwords which are strings of random lower case, capitals, symbols and numbers.
If one of your online accounts gets compromised, you can tell it to automatically refresh that password for you. Or all of your passwords.
It monitors the dark web for the emails you use in accounts and alerts you if one shows up.
And it will tell you if one of your online accounts has been compromised (they watch the news for these events).
More features - highly recommended.
KeePass. Been using it forever.
I don’t trust cloud based password managers.
“My Microsoft browser gets used once. That is when I download a different browser.”
Ditto. Then I take it off the task bar. I keep it for the rare occasion where I have to access a web site that will not work on other browsers.
We are the BORG: We will lower your shields and add your passwords and technological data to our own.
I just installed Kubuntu 21.04 on a old Optiplex 755, putting it on a used $16 128GB Sandisk SSD, but how is it that after trying the live versions of over 12 most current Linux distros not one would show or configure even one of 3 USB wireless adapters (as Windows shows)? Where is there a default Linux disk manager comparable to Windows?
I keep all passwords in a journal... one page per site. Then if I want to change the password I cross off the old one and write the new one under it.
The encryption used to secure browsers derived from Firefox has been peer reviewed, and is actually better than most people think. Use a password to secure your browser, and it should foil this hack by microsoft.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.