How safe is the password manager in browsers?

Question

For example, Opera has a "wand" feature that remembers user names and password you typed across various sites.

Let's say you get a trojan, which steals data from your PC. Can the trojan decrypt stored passwords by browsers, and use them?

Answer 1

The points noted in Bob's answer are all valid, so I won't bother repeating them; however, I thought a little additional information might also be helpful for some, as your question is a valid concern.

• Opera's Wand feature allows you to specify how frequently to ask for your master password under Preferences > Advanced > Security > Ask for password with selections such as "Once per session" (which, as Bob correctly points out, limits your security), "Every x minutes/hours" (if you don't mind fiddling with .ini files, you can customise your own frequency), and "Every time needed" (obviously the most secure option as your password will not be stored in memory during your browsing session). I don't use Firefox but can imagine that there's a similar extension available somewhere.

• The Wand data is stored in a file called, wait for it, wand.dat in a format that can be deciphered with relatively little effort if no master password is used; if you do use a master password, it is encrypted using a random component and your master password with an algorithm that currently escapes me (should be easy to look up though).

• If you use a password for a site whose security is more important to you than the average login, you can simply choose not to save the password.

• Private tabs in Opera (or their equivalent in other browsers) allow you to store that tab's session data separately from that in "normal" tabs, which may add another layer of security.

• The security model used in Chrome and its derivatives (that is, sandboxing each tab in a separate thread) gives you even greater security.

• You can guard against keyloggers and such by regularly:

  • updating your anti-virus and firewall software; and
  • changing your passwords.

To sum up:

• Your browser's level of security and that of your logins is up to you to a large extent.

• If someone was very skilled and resourceful, they could probably get at your data eventually despite all the above precautions, but it would make your browser's data far more secure and would raise the level of sophistication required to crack it significantly.

Answer 2

• If you have malware on your computer, no passwords entered or stored on it can be considered truly safe. Even encrypted passwords such as KeyPass databases, as soon as you enter the details required to decrypt it the attacker can retrieve your passwords.

• Browsers typically do not pay very much attention to the security of saved passwords, at least not with default settings.

---

Let's say you get a trojan, which steals data from your PC. Can the trojan decrypt stored passwords by browsers, and use them?

In a word: yes. Browsers typically do not encrypt remembered passwords, so they can be read with trivial effort. Encryption with a stored key is useless anyway: if the browser is able to decrypt it, other programs running on the same computer can do the same.

I'm most familiar with Firefox, so I'll go with that.

Firefox allows you to set a 'master password'. If you do, it encrypts the stored passwords with the master password. However, for the sake of convenience, you only have to log in using this master password once per session. Once you are logged in, the information necessary to decrypt saved passwords is stored in memory, and can be accessed. A more secure and cumbersome approach would have been to require the master password to be typed every time Firefox needed to look up a saved password.

Even if the saved passwords were perfectly encrypted and completely inaccessible, they must be decrypted and entered on web forms at some point. Which means holding the passwords, unencrypted, in memory. There are actually quite a few 'asterisk revealer' programs designed to grab those passwords out of memory and, well, reveal them. Malware could theoretically do the same.

And malware could also keylog you, allowing the attacker to retrieve any password you typed.

Answer 3

NirSoft provides a tool called "IEPassView" which can decrypt Internet Explorer 8 and under passwords. System Information for Windows can do the same; just click on the key at the top.

NirSoft provides "password recovery" tools for many popular browsers (http://www.nirsoft.net/password_recovery_tools.html) -- these make a good "proof of concept" to show that the built-in password storage isn't safe.