Edge stores passwords in plaintext memory at startup; a tool has been released to test against the flaw.

you are viewing a single comment's thread
view the rest of the comments
[–] 11 points 4 months ago (3 children)

This requires reading application memory

  • source
  • hideshow 3 child comments
  • [–] 17 points 4 months ago* (2 children)

    Seems like a pretty basic security precaution to avoid loading decrypted secrets into memory before they're needed. Someone who can access application memory can already own you but there isn't really a good reason why they should be able to access secrets that you never accessed while they were in.

    I wouldn't say it's an alarming flaw, just seems weirdly and unnecessarily unsafe

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 4 months ago (1 child)

    At some point they will need to be decrypted anyway

    I think this was done for performance and simplicity

  • source
  • parent
  • hideshow 1 child comment