ISSUE 18.26.F • 2021-07-12

If you purchase after clicking this ad, AskWoody may receive a small commission.

PUBLIC DEFENDER

By Brian Livingston

When some readers installed the new Microsoft Edge browser — which replaces the old “legacy Edge” — they got a big surprise. They discovered that Edge had somehow magically absorbed all the usernames and passwords they’d carefully saved in their previously installed browsers, such as Chrome, Firefox, Internet Explorer, and legacy Edge.

What’s even more surprising is that Edge — which until recently couldn’t import or export passwords at all — may be doing this new behavior by design.

The bad news is that you shouldn’t store passwords in Edge in the first place — or in any browser, really. This may allow other programs, including malware, to read passwords that are stored in machine-readable files. Please read on.

The password-vacuuming behavior described above occurred because of the following sequence of events, according to one reader:

Figure 1 shows the dialog box the reader photographed with his phone. This yes-no query might be named “May I import the passwords from Edge that you didn’t know Edge already had a copy of?”

Figure 1. When Edge was installed, it copied the passwords that had been stored by an existing instance of Firefox, a reader claims. When a new version of Firefox was installed without copying any passwords, it asked the user whether it should sign in to sites such as Social Security by importing login credentials from Edge. (I’ve highlighted Firefox’s request with an orange box.)  Source: Screen shot from reader’s smartphone

Other users have reported a similar sequence of events involving Edge and Chrome browser. In August, one poster said on the official Microsoft Answers forum for Edge:

I have no idea how this happened, but after updating my computer, Microsoft Edge opens up, which is normal I suppose, but they got my Google Chrome passwords and bookmarks without my consent …

Moderators quickly responded that Edge importing Chrome’s stored passwords without user approval “wasn’t very likely.” Edge is supposed to present the dialog box shown in Figure 2, asking whether to import or not import.

Figure 2. When Edge is installed, it’s supposed to present the user with a dialog box asking whether it can import saved passwords from whichever browser the user had previously used the most.  Source: Microsoft Answers page

The history of Edge’s and other browsers’ stored passwords is a bit hard to follow. As recently as June 2020, users complained that Edge had an “export passwords” function but no ability to import passwords from other browsers at all.

Much later, on April 21, 2021 — just three months ago — users began reporting in Microsoft Answers posts that Edge had gained an import feature, but only in a private Insider Channels build and then only if a special command line were entered.

A long article, updated by a Microsoft Ambassador, finally describes on July 2 all
the ins and outs of how Edge stores and manages passwords.

Separately, an undated and unsigned Microsoft support document explains the rules Edge follows when it decides whether to copy a previously installed browser’s saved passwords:

Whew! That’s a lot to take in. But you don’t need to remember all of the above. All you need to remember is that most browsers store your saved passwords in an unsecure way that malware can silently copy and send to a hacker’s server.

I urged my readers to establish a “master password” way back in a November 23, 2004, article, which remarkably is still online. Back then, the exciting new browser was Firefox 1.0. It was the only browser that allowed you to enter an overall string that would encrypt your saved passwords, protecting them from snoopy co-workers and hidden malware. IE certainly couldn’t protect you.

I can’t believe that almost 17 years later I still need to ask people to do this. Browsers should encrypt your saved passwords by default. But most don’t.

The German Federal Office for Information Security (BSI, in German) audited Edge 44, IE 11, Chrome 76, and Firefox 68 in September 2019. Firefox was the only browser that supported a master password. (Mozilla now calls this the “primary password.”) Chrome and Edge also lacked an option to block telemetry collection and provide organizational transparency.

As a result, BSI recommended that German agencies and businesses use only Firefox. For more information, see a ZDNet article and a Forbes summary.

As recently as April 9, 2021, a poster at the Microsoft Tech Community forum announced that a master-password feature had been spotted in a beta version of Edge. However, it’s only a “controlled feature,” meaning it’s not yet in wide distribution.

As of July 6, Microsoft’s official feature roadmap for Edge said: “Require authentication before auto-filling passwords.” The target date was given as April 2021, but the status of this feature was still described as “in development.”

I asked Microsoft officials how Edge handles saved passwords from other browsers. According to Microsoft, “Microsoft Edge does not directly pop-up or autofill data from other browsers. Instead, customers have the option to import their browsing data from other browsers to Microsoft Edge based on their interest and consent.”

Regarding reports that Edge had copied saved-password files from Chrome and Firefox without user approval, Microsoft’s statement said this: “The Edge password import feature is now enabled by default in all Microsoft Edge Channels. It can be found on the edge://settings/passwords page inside the Overflow Menu of the Saved Passwords table. Microsoft is looking into the reports you shared and monitoring feedback to improve customer password import experiences.”

There’s good news on whether Edge will soon allow users to enter a master password that would encrypt any username/password combinations that Edge saves. “Microsoft will offer this functionality closer to end of July. If you are on a shared device or have left your computer unlocked, you can opt to add a second verification using your device password to avoid others accessing your website credentials or auto-fill data.”

The statement added: “For more information on Microsoft Edge’s encryption method, please see this support doc: Microsoft Edge password manager security.”

When someone who really knows what Edge is doing with passwords becomes available, I’ll write more about it in this space.

That Microsoft support document states: “Microsoft security baselines recommend disabling the password manager.” The reason is that a computer worm that compromises a network of PCs could obtain all the passwords stored by every browser on the network.

For all the above reasons, I’m going to tell you now not to store passwords in browsers at all.

Despite the precautions browsers may take, your usernames and passwords are prime targets for hackers. Your stored credentials may include the keys to your bank account, your credit union, your credit cards, and more.

The Mitre Att&ck website lists in Document T1555.003 more than 70 attack vectors that are currently circulating to scrape your passwords out of whatever files various browsers store them in. The security group also lists numerous exploits that hack into the old Windows Credential Manager and even some password managers, such as KeePass.

Do you think your PC could never become silently infected by malware?

Don’t be so sure.

People who downloaded a completely legitimate, open-source video transcoder, HandBrake, learned only later that its server had been hacked. Installing the video app silently inserted OSX/Proton, a Trojan horse that was designed to infect Macs. The developer warned customers in a Web posting that half of all their downloads between May 2 and 6, 2017, had contained the malware, according to an Objective-See blog post.

More recently, viruses have emerged that constantly monitor the Windows Clipboard. This could lead to many nefarious acts, but the so-called Clipboard Wallet Hijacker watches for transactions that move digital currency from one of your wallets to another. If this occurs, the malware changes the destination from your crypto account to its own. The security firm 360 Total Security has detected this silent robber on more than 300,000 computers, according to a July 1 Laptop Mag article.

As a first step to protect yourself, you should turn off all of your browsers’ capabilities to store usernames and passwords. Then delete any credentials it stored. Edge has a simple check-box to do this if you select Settings, Profiles, Passwords, as I explained in my May 17 column.

There are many good password managers, but in that same column I noted that 1Password is the top choice of CNET, Wirecutter, Wired, and several other test sites. It’s not free, costing $3/month for a single user or $5/month for five people. But 1Password is worth it for its support of industry standards and two-factor authentication (2FA) using small USB fobs as well as the MS Authenticator and Authy mobile apps.

Password managers can help you enter passwords into apps that aren’t websites and don’t use a browser. For instance, you may have programs that connect you to sensitive services without there being any webpage to sign in on.

Until a better system than usernames and passwords catches on, we all need to secure these valuable little character strings as best we can.

Do you know something that we all should know? Tell me about it! I’ll keep your identity totally confidential or give you credit, as you prefer. Send your story via the Public Defender tips page.

Join the conversation! Your questions, comments, and feedback about this topic are always welcome in the AskWoody Lounge!

The PUBLIC DEFENDER column is Brian Livingston’s campaign to give you consumer protection from tech. If it’s irritating you, and it has an “on” switch, he’ll take the case! Brian is a successful dot-com entrepreneur, author or co-author of 11 Windows Secrets books, and author of the new book Muscular Portfolios. Get his free monthly newsletter.

If you purchase after clicking this ad, AskWoody may receive a small commission.

You’re welcome to share! Do you know someone who would benefit from the information in this newsletter? Feel free to forward it to them. And encourage them to subscribe via our online signup form — it’s completely free!

Like what you see in the AskWoody FREE newsletter? Become a PLUS member! As a Plus member, you’ll receive the full newsletter, including all our great content about Windows, Microsoft, Office, 365, PCs, MS-DEFCON Alert notifications, useful and safe freeware, and Susan Bradley’s sought-after patch advice. Plus membership also allows continuous access to the complete archive of nearly two decades of Windows Secrets and AskWoody Newsletters. Naturally, Plus members have all the benefits of free membership, including access to the popular AskWoody forums. The cost? We’re supported by donations — choose any amount for a one-year membership. Every little bit helps.  Join AskWoody PLUS Today!