back to article Microsoft Edge goes homomorphic: Nobody will see your credentials... but you'll need to sign in to use it

Microsoft has detailed how the Password Monitor feature in Edge works after it pushed version 88 of the browser into the Stable channel. The release follows the recent first anniversary of Chromium-based Edge emerging from preview. The Password Monitor feature was rolled out in an update tilted towards "transparency and …

  1. Anonymous Coward
    Anonymous Coward

    All your web viewing habits

    are belong to M$.

    1. NetBlackOps Bronze badge

      Re: All your web viewing habits

      Some do, some don't. That's why I have multiple browsers with tailored extensions covering different sites. A bit of effort, yes, but certain sites such as El Reg get a pass, while others get default hard lockdown.

  2. Tomislav

    On the plus side, it will work on macOS.

    I am sure those two Edge on MacOS users will appreciate the feature. :)

    1. John Brown (no body) Silver badge

      Re: On the plus side, it will work on macOS.

      It looks like neither of them do appreciate it and a third user is upset because you overlooked him.

  3. Anonymous Coward
    Anonymous Coward

    Huh?

    What am I missing? I have been writing software for decades that only stores a hash of the passwords given it, and when the user inputs a password to gain access, the hash of the candidate password is compared to the hash of the real password. This has been standard practice everywhere I have worked since the dawn of time. This is considered new & innovative?

    1. itzumee
      Happy

      Re: Huh?

      Wahey! I'm an innovative software developer who's way ahead of the infosec curve

      1. Anonymous Coward
        Anonymous Coward

        Re: Huh?

        No, but it's pretty clear why you are unemployed.

      2. This post has been deleted by its author

    2. claimed

      Re: Huh?

      I think the distinction is that you are hashing the password provided, before the comparison (otherwise thats essentially a plain text password with less entropy). MS are claiming they can send the hash off to check it against a list (haveibeenpwnd, probably!) without downloading the whole list to every browser, and without sending specific hashes off which, if discovered, then whittle down your known list of passwords. Quite why all this palava is better than an HTTPS API against the source, I dont know. I can only assume they don't want to pay Troy Hunt to increase his request limits and they want to show off!

    3. Frank Marsh
      Thumb Up

      Re: Huh?

      Keep reading down the comments to get to blazde. He/she had the technical details missing from the article.

      1. Anonymous Coward Silver badge
        Linux

        Re: Huh?

        Microsoft say they're doing something, so they must be doing exactly that and nothing else.

        Yep.

        Trust is hard to earn. Microsoft have some way to go in my opinion. So do all the other companies to be fair.

  4. Danny 2 Silver badge
  5. Blackjack Silver badge

    Haven't we seen this before?

    Password manager manages your passwords then they get the password to your password manager and you get ruined.

    So no thank you, I know how this story ends.

    1. Danny 14 Silver badge

      Re: Haven't we seen this before?

      Dont let them get your password. Ive had a key that operates my car and another that opens my house. Im yet to lose either.

    2. Anonymous Coward
      Anonymous Coward

      Re: Haven't we seen this before?

      DIdn't that M$-owned LInked-In site's users get all their passwords powned?

  6. Hubert Cumberdale Silver badge

    "Microsoft's twist"

    Erm, unless I'm missing something, hasn't Firefox been doing something like this with email addresses for two and a half years? And haveibeenpwned has certainly been doing it with passwords for quite a while. In any case, it's a bit of a stretch to call it a "twist" like they've had some magic new idea.

    1. Blazde Silver badge

      Re: "Microsoft's twist"

      The k-Anonymity solution is checking whether a hash of client's choosing exists in a big dictionary of hashes on the server and involves returning a portion of the big dictionary to the client. That's not so bad because these big credential lists are semi-public anyway, but it's not ideal. Further the server has some idea of which data was queried because it may be in the returned data, and the server (for some scenarios) knows the corresponding plaintexts for hashes in it's dictionary. For example if the client queried a series of hashes of email+password pairs the server could easily deduce the email address that was common between the returned subsets. I suppose that's the reason they're implemented to check only password hashes (HIBP) or only email addresses (Firefox), rather than full credential combinations? (Hopefully I have all this right).

      MS's solution appears to be checking full credential combinations and essentially involves revealing the existence or not of the credentials in the dictionary to the client, and nothing to the server. The server receives credentials encrypted by a session key only the client knows, so it cannot even know whether two queries are identical or not. The client meanwhile only learns whether a credential is in the dictionary if it knows it's full hash ahead of time. It can't download a bunch of hashes en masse and then attempt to crack them together efficiently.

      That's the idea anyway. There are lots of details they've had to add to the protocol to make it computationally tractable and potentially there's some weakness in it. I guess we'll see.

  7. Anonymous Coward
    Anonymous Coward

    Just choose a decent password and you will be OK without these "features" ... my default password is "badpassword" it's never been hacked, if it's ever hacked all I would have to do is drop the "p" and continue... I'm posting anonymously to protect my username and keep the password safe..

    1. TimMaher Silver badge
      Thumb Up

      badassword

      And if that got hacked you could swap to the UK spelling:- “badarseword”.

      1. Eclectic Man Silver badge
        Coat

        Re: badassword

        Ahem, the UK version is Shirley "baddonkeyword"

        1. WolfFan Silver badge

          Re: badassword

          No, it’s “badBorisJohnsonWord”.

    2. Flocke Kroes Silver badge

      Automatic reminder

      Always use the password "incorrect". If you ever forget your password your computer will remind you what it is

    3. Robert Carnegie Silver badge

      My work password was six actually random letters and two numerals and would have been less if allowed... then the penetration testers got it. No it wasn't MODNAR00 (I think). I was invited to an interesting and reasonably civil chat with management.

  8. fidodogbreath Silver badge

    neither Microsoft nor miscreants-in-the-middle can read a user's credentials

    Says Microsoft.

    1. Anonymous Coward
      Anonymous Coward

      Amazing the disablement of commentards who can't even lookup the technical terms.

      Homomorphic encryption, as in "allowing one to perform calculations on encrypted data without decrypting it first."

      Similarly I can see you're intellectually lazy without actually having to look at you.

      1. Robert Carnegie Silver badge

        I see what it's called, but how does it work? How can it work? Does it ROT13 code all the data twice?

        1. SCP

          Robert Carnegie wrote: "How can it work?"

          A toy example was given in comments to <https://forums.theregister.com/forum/all/2016/02/09/researchers_break_homomorphic_encryption/>

          "> You can't do data analysis on data that you don't have.

          As an illustration: Let us suppose that the analysis consists of multiplying two numbers together and checking whether they are greater than another pair of numbers multiplied. This analysis is to be provided without revealing what the numbers are.

          The data owner can provide the numbers as logarithms of some 'secret' base; not knowing the 'secret' the analyser cannot discover the numbers. But, they do know how to multiply numbers expressed as logarithms (you add them) and they do know logarithms maintain order. Therefore they can complete the analysis without knowing the actual numbers.

          Obviously in a truly secure system the techniques and the maths are more complex."

          HTH

      2. fidodogbreath Silver badge

        "allowing one to perform calculations on encrypted data without decrypting it first."

        I understand the concept. I also understand that encryption and security in general are often incorrectly implemented, and that Microsoft doesn't exactly have a spotless record in that regard.

  9. Eclectic Man Silver badge

    Password length

    I was once doing a review of security at a government agency which had offices all over the country. In the local office there was, according to their security officer, a minimum password length set of 10 characters. The SO wanted to come with me as I interviewed staff, and I said ok, but please don't say anything, and the staff might just say things that surprise you if they forget you are there.

    Well, two ladies were interviewed together, and I asked about the length of their passwords. One was adamant the hers was only 8 characters, and she tested it (without revealing it), and it was only 8 characters.

    The SO was quite surprised and, fortunately, impressed. There followed a review of the IT security implementation (by him not me).

  10. Ken Hagan Gold badge
    Thumb Up

    "No one wants a personalized ad based on browsing history ruining all the fun," said Microsoft, using the example of a surprise gift's recipient perhaps seeing an ad over the user's shoulder.

    A prize to whoever thought up *that* example so that they didn't have to admit the *actual* motivating example.

  11. chriskno

    This may not be the right lace to ask this question, but I will. Does anyone know why Google stupidly sends ads of products I have just bought? I would have thought there would be some mechanism to register the buying process and act accordingly.

    1. Eclectic Man Silver badge

      Not just Google

      I don't but I was somewhat surprised that after buying a new CD player and amp from one company they sent me sales brochures for their CD players and amplifiers for over 2 years.

      I can only assume they were hoping that the products I had bought had so impressed my friend(s) that there was the possibility of a follow-on sale.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Biting the hand that feeds IT © 1998–2021