New MS Edge feature?

[Masquernom]

I'm suddenly getting popup warnings from Microsoft Edge browser that my password and login for various websites have been compromised, and that I should change my passwords. At first, it was one here and there. Tonight I got notice for 12 different web sites.

Anyone else start getting these warnings?

 

[Boho]

It's a new feature. https://www.microsoft.com/en-us/res...tor-safeguarding-passwords-in-microsoft-edge/

"[January 21, 2021] to further bolster that trust while keeping our customers safe, we introduce a new feature called Password Monitor. The feature notifies users if any of their saved passwords have been found in a third-party breach."

 

[zinger1457]

As inconvenient as getting all those messages may be it is warning you of a problem. Are you using the same password on multiple sites? I think you would be better off using a dedicated password manager (Lastpass, Bitwarden, etc.) browser add-on and turn off the Edge browser setting to remember logins and passwords. The password manager makes it easy to generate secure unique passwords for each site and makes it easy to login.

 

[Sunset]

I'm suddenly getting popup warnings from Microsoft Edge browser that my password and login for various websites have been compromised, and that I should change my passwords. At first, it was one here and there. Tonight I got notice for 12 different web sites.

Anyone else start getting these warnings?

Nope, because I use keepassXC (a password manager) , so every site has a different long complex password.

It's free and works really well.

 

[target2019]

I'm suddenly getting popup warnings from Microsoft Edge browser that my password and login for various websites have been compromised, and that I should change my passwords. At first, it was one here and there. Tonight I got notice for 12 different web sites.

Anyone else start getting these warnings?

I use LastPass to manage all passwords, so any browser I use is protected by a similar feature. When I first deployed LastPass I used the feature to go out and re-check my logins and passwords against the known hacking databases. It found just a few since I had been aware of many breaches as they occurred and already fixed them.

Other features that are necessary include duplicate logins or passwords, as well as weak passwords.

 

[Masquernom]

I guess it's time to research password software....

 

[Midpack]

Nope, because I use keepassXC (a password manager) , so every site has a different long complex password.

It's free and works really well.

Interesting. Free, but contributions accepted. I’m always leery of a free product that obviously has commercial value - usually free means “you’re personal data is the product” but KeePassXC does appear to be legit if you trust a community of 6 people in various countries versus a commercial password manager like LastPass.

KeePassXC appears to be a great password manager as long as the user really knows how to secure his/her PC, including NOT using an auto login feature (most people do?). All your passwords are stored locally on your PC (other devices?), so a brute force attack can expose all your passwords. KeePassXC may not be a good solution for a casual user, it’s not quite as user friendly and doesn’t have much customer support.

BitWarden is another option.

 

[jim584672]

I don't want my browser looking at my passwords, I would pass on this browser.

 

[zinger1457]

I don't want my browser looking at my passwords, I would pass on this browser.

Most if not all browsers have the option to look at and remember your passwords, it's your choice whether you allow it.

 

[jim584672]

Most if not all browsers have the option to look at and remember your passwords, it's your choice whether you allow it.

Remembering a password in the browser is a lot different than taking the password to check it against an external database.

 

[zinger1457]

Remembering a password in the browser is a lot different than taking the password to check it against an external database.

If you turn off the option for the Edge browser to remember your password it doesn't check it.

 

[target2019]

Users pretty much defend what they are using. Companies always defend the safety and security of their apps, but we all should know that plays out differently from time to time.

App defaults have changed many times in the past without a user knowing about it.

I no longer use browsers to store passwords. But I suspect that is safer than having the browser store password and also send it over encrypted channel for decrypting and comparison at some server.

There are always system tradeoffs, and you can't be certain your choice today is good forever.

 

[jim584672]

Microsoft does publish the source code since it is based on Chrome which is a copyleft license and they are required to publish it. The experts can look and see exactly what is being done, so that gives some reassurance.

 

[bloom2708]

Chrome also does this if you store passwords. They are checking the massive "known hacked username/password" databases on the dark web.

If you use 2 factor everywhere you can, this can also deflect issues. Once your password is exposed, people with time on their hands will just try that combo all over and hope for a success.

Not re-using passwords, using a password manager and using 2 factor all help.

 

[Midpack]

Users pretty much defend what they are using. Companies always defend the safety and security of their apps, but we all should know that plays out differently from time to time.

App defaults have changed many times in the past without a user knowing about it.

I no longer use browsers to store passwords. But I suspect that is safer than having the browser store password and also send it over encrypted channel for decrypting and comparison at some server.

There are always system tradeoffs, and you can't be certain your choice today is good forever.

That's what has kept me from using a Password Manager. It's rare but password managers get hacked like everything else online. For every hack that we hear about, I wonder how many go unreported or totally undetected?

2014
LastPass, My1Login, NeedMyPassword, PasswordBox, and RoboForm: Researchers at the University of California Berkeley discovered a number of vulnerabilities in a handful of password managers. “In four out of the five password managers we studied, an attacker can learn a user’s credentials for arbitrary websites,” researchers Zhiwei Li, Warren He, Devdatta Akhawe, and Dawn Song wrote in their paper.
RoboForm: IT security consultant and tech enthusiast Paul Moore discovered one critical vulnerability in and a privacy loophole in the password management service that could allow attackers and prying eyes to obtain users’ personal data, including stored login credentials of various websites and even card payment details.
2015
KeePass: When this program runs on a computer where a logged in user has the KeePass database unlocked, KeeFarce (a hacking tool) decrypts the entire database and writes it to a file that the hacker can easily access. In theory this kind of hack makes all password managers vulnerable.
LastPass: An intrusion to the company’s servers was detected. While encrypted user data wasn’t stolen, cyber criminals stole LastPass account email addresses, password reminders, server per-user salts, and authentication hashes.
2016
MyPasswords, Informaticore, LastPass, Keeper, F-Secure Key, Dashlane, Keepsafe, Avast Passwords, and 1Password: This was a busy year in terms of password management vulnerabilities. TeamSIK (Security Is Key), a group of people interested in IT security from the Fraunhofer Institute for Secure Information Technology, discovered serious security flaws in the most popular password management apps developed for the Android platform.
2017
LastPass: Google Project Zero Hacker Tavis Ormandy discovered a critical zero-day flaw that allowed any remote attacker to compromise accounts completely.
LastPass: Tavis Ormandy discovered a vulnerability in its browser plugins, which LastPass called a “major architectural problem“. The password management service advised users to avoid using its browser plugins while it dealt with the issue.
OneLogin: An attacker had “obtained access to a set of AWS keys and used them to access the AWS API from an intermediate host with another, smaller service provider in the U.S.”
Keeper: Tavis Ormandy discovered that the service was exposing passwords to unreliable web pages.

https://dpl-surveillance-equipment.com/cyber-security/which-password-managers-have-been-hacked/

 

[Masquernom]

I have been worried about storing passwords on my personal computer. I only let the browser save the password for what I consider non-important web sites. Any bank, credit card, or investment web site, or any web site involving money, I don't allow the browser to save the password. I also don't save my credit card information on any web site for re-occuring purchases unless I have too.

I have always avoided password managers because I assumed they could also be hacked. If the password isn't stored on the computer, it can't be hacked. I do have some questions about password managers.

1) Once the password manager has issued a password to a web site, how do you later change it if you want to?
2) Once the manager has issued a strange password to a web site, how do you log into that web site from your smart phone? From your work computer?

 

[Masquernom]

All of the notifications I've received have been from pretty minor web sites. I'm just really surprised how many. Probably 15 so far. They almost all have different passwords too. Some have different login ID's too.

Have that many web sites been hacked and given up the login data?

 

[easysurfer]

No warning for me as I don't use Edge .

But don't other browsers usually have a similar feature?

I use FireFox and decline the chance to have the browser save my passwords.

Instead, I use a password manager program (local desktop computer) and passwords are random.

For other devices (laptop, phone) I don't keep all the passwords on them, just only a few for frequently accessed things (like Facebook).

 

[Gotadimple]

All browsers will save passwords if you let them. But now, Firefox, Chrome, and Edge are looking at the database of your passwords to see which have been exposed and warning you. You can turn off the feature.

For email you can use https://haveibeenpwned.com/ and have it monitor if your emails have been compromised. I noticed at the beginning of the year that Google mail also attached Avast to my email account to monitor it for breaches. They all do something to keep your customer loyalty.

- Rita

 

[easysurfer]

All browsers will save passwords if you let them. But now, Firefox, Chrome, and Edge are looking at the database of your passwords to see which have been exposed and warning you. You can turn off the feature.

For email you can use https://haveibeenpwned.com/ and have it monitor if your emails have been compromised. I noticed at the beginning of the year that Google mail also attached Avast to my email account to monitor it for breaches. They all do something to keep your customer loyalty.

- Rita

Ok. Thanks for clarification.

I want no part of having the browsers looking at my database of passwords. Happy to just maintain the passwords on my own.

 

[Sunset]

That's what has kept me from using a Password Manager. It's rare but password managers get hacked like everything else online. For every hack that we hear about, I wonder how many go unreported or totally undetected?
https://dpl-surveillance-equipment.com/cyber-security/which-password-managers-have-been-hacked/

And if you type in your passwords a keylogger will report the password and login to the hacker.

Nothing is safe.

 

[Sunset]

Interesting. Free, but contributions accepted. I’m always leery of a free product that obviously has commercial value - usually free means “you’re personal data is the product” but KeePassXC does appear to be legit if you trust a community of 6 people in various countries versus a commercial password manager like LastPass.

...

Do you trust commercial companies that employ people all over the world via off-shoring in various countries as is done by very many companies, but they don't usually tell you about it.

 

[Masquernom]

I downloaded and took a look at Keepass, a free password manager. I assume it works similar to most other password managers. It appears all the password manager does is provide a secure file on your computer to store your passwords and autofill a website when you open it. It doesn't generate a new password for the sites every time you visit them.

If your user ID and password is exposed by hacking the web site, a password manager is no protection to you. No matter how long, or complex your password, if they have it, they have it.

Why was everyone recommending password managers?

 

[target2019]

Because it provides another layer of security. Defense in Depth they call it.

 

[Gotadimple]

I downloaded and took a look at Keepass, a free password manager. I assume it works similar to most other password managers. It appears all the password manager does is provide a secure file on your computer to store your passwords and autofill a website when you open it. It doesn't generate a new password for the sites every time you visit them.

If your user ID and password is exposed by hacking the web site, a password manager is no protection to you. No matter how long, or complex your password, if they have it, they have it.

Why was everyone recommending password managers?

You are describing three different problems.

The first is a website being hacked and user IDs/passwords being exposed. It can happen. It has happened (see Equifax). When it happens you change your password to protect your details.
The second is password storage and site form fills, this avoids a keylogger capturing your user and passwords as you type them.
The third is always altering your password. A key fob that issues a one-time password is one solution - they need to be provided by the website owner. Many password managers can generate a new unique password, but you need to update that at the website before you use it. 2 Factor authorization has replaced key fobs in many places. Financial institutions generally offer 2FA.