How do current web browsers (or mobile mail clients and any software in general) save user passwords? All answers about storing passwords say we should store only hashes, not the password themselves. But I'm having a hard time searching the web trying to find the best techniques to store passwords when we know we will need them in plain text later on — without storing them in plain text, without using a weak encryption (known key) and without asking the user for a master password. Any ideas?
locally it is either stored as plain text or encrypted.
when encrypted the en/decryption key can be fixed per browser (hardcoded in the executable), per machine (generated at install and stored in the install directory) or per user (generated at first time use of password manager and stored in the
or they can be combined: the user level key is encrypted with the machine level key so that when malware takes the file where the passwords are stored it is stored it is useless without the user level and machine level keys
Some browsers also allow you to use a "master" password which which is combined with the existing key to provide more security
when you use a (good) synchronization service the passwords are never stored in plain text on the server. Xmarks for example uses a separate key to your normal sync password to encrypt the passwords and never sends that key to the server (if you want to see the stored passwords on the site it is decrypted locally)
The passwords are stored in plain text, unless a master password is used.
When people tell that you must store only hashes of passwords, they are talking about server-side storage, not client-side.
When you have your own website when the users can register/logon with their passwords, you don't need (and must never) store the passwords themselves:
Browsers are different. They store the passwords on client machine, and must have an original password, not a hash.
This means that those passwords are stored in plain text in most cases.
Note that most browsers enable the users to sync their data across multiple machines. The sync uses a remote server to store the cookies, history, bookmarks and passwords. For example, Chrome uses Google servers to store this data.
In this case, the passwords are never stored in plain text on sync servers, otherwise, it would be a security issue. In Chrome, you have to choose the master password for sync (or use the one from your Google account). This master password will be used to encrypt the passwords (always), and other data like the history or the bookmarks (optional).
¹ For the sake of simplicity, you can imagine that the different passwords cannot have same hashes. In theory, this is wrong, since collisions may exist. In practice, if you use a strong hash algorithm, like SHA-256, you can neglect the risk of collision for a website even with millions of registered users. Things are different if you use an obsolete and depreciated hash algorithm, like MD5.
These programs need the password in clear text (they need to submit it when requested). It is therefore stored as plain text. Many browser allow to encrypt all the stored passwords with a master password (asked only once).