Linus Tech Tips Discussion

 Edge browser leaves passwords exposed in plain text, says researcher Summary A Norwegian researcher has identified an issue with Microsoft Edge’s Password Manager that could be a serious concern for businesses. Tom Jøran Sønstebyseter Rønning found that passwords are being saved within the browser in plain text, with the effect that any PC, particularly a shared machine, within an organization is a potential risk.   Quotes Quote In a post on X, Rønning explained that when users save passwords in Edge, the browser decrypts every credential at startup and keeps it resident in process memory, regardless of whether the user visits the site.   Rønning’s finding was replicated by German IT publication Heise.de, which created and saved a password and found that, even after the browser had been closed and re-opened, the password could be found in plain text.   Microsoft has been nonchalant about the discovery. It said, “Design choices in this area involve balancing performance, usability, and security, and we continue to review it against evolving threats. Browsers access password data in memory to help users sign in quickly and securely — this is an expected feature of the application.” Microsoft dismissed the significance of the passwords’ visibility, saying, “Access to browser data as described in the reported scenario would require the device to already be compromised.”   My thoughts I use Edge at work do to requiring access to certain Legacy web Applications and just stuck with it as a regular browser at work.  At home I've shifted to Firefox and currently enjoying the experience and I've used Google Chrome in the past and may go back to it at work as it's been approved to use over Firefox (I believe it has to do with Enterprise Management) and just use edge when needed. Do you think Microsoft fixes this in the coming days or simply ignore it. I feel that because this is in the open, Microsoft will have to fix this an enable password encryption on Edge as Enterprise may very well disable the option to save passwords in the browser moving forward until this is fixed and passwords are encrypted.    Sources  https://www.computerworld.com/article/4167430/edge-browser-leaves-passwords-exposed-in-plain-text-says-researcher.html