Post #2040693

2026-05-05 17:35 UTC

@KF0UNK the difference is that other browsers only expose the one password you request at that moment and only for as long as it takes for you to log in to the service you need it for. Edge decrypts and stores all your passwords in plaintext in memory as soon as it launches and keeps them there until you close the browser. It’s a night and day difference.

Replies (2)

@KF0UNK@mastodon.hams.social 2026-05-05 17:37

@kaidenshi I'm just saying that from a security model I consider anything in the browser password cache to be insecure. I shared this reply because I have researched this in the past and my finding was that I should generally assume all the passwords in any browser are compromised if the adversary has memory access.

Open ##2040694
@david_chisnall@infosec.exchange 2026-05-06 07:01

@kaidenshi @KF0UNK Not really. Edge: The passwords are in memory, an attacker who can dump memory can read them. Chrome: The passwords are encrypted, but the decryption key is in memory. An attacker who can dump memory can read the decryption key and read them. Both models are vulnerable to the exact same set of attacker capabilities. From a threat-model perspective, they are not different. If your threat model is ‘administrators on the system must not see my passwords’ then you have problems that cannot be solved on conventional operating systems on conventional hardware.

Open ##2073882