Google Chrome Will No Longer Show 'Protected' At HTTPS Sites

To celebrate the tenth anniversary of Google Chrome, a new version of the browser has appeared that does not show the word 'secured' at https sites, makes using Flash Player more difficult, introduces an improved password manager and fixes 40 security vulnerabilities.

On 2 September 2008 , Google launched its own browser, which has since become the dominant browser. According to StatCounter, Chrome has a market share of almost 68 percent on the desktop . In the Netherlands, around 54 percent of desktop users would browse with Chrome. Yesterday evening the 69th version of Chrome appeared that contains all kinds of new features and improvements.

This allows Chrome 69 to enter passwords, address details and credit card numbers more accurately. It is data stored in the user's Google account and accessible directly from the Chrome toolbar. The browser also has an improved password manager that can generate unique passwords for websites and accounts. Saved passwords are then available to users with a Google account on both the computer and mobile devices.

Furthermore, Chrome 69 does not show the word "secured" on websites with a secure connection. Only the lock icon indicates that a secure connection is being used. Eventually the lock icon will also disappear. Google decided in July to display the message "Unprotected" at all http sites. The internet giant wants https sites to be the norm and users will only see a notification at http sites.

Also, in the browser measures have been taken to make the use of Adobe Flash Player more difficult. Previously, users could whitelists websites that wanted to access the built-in Flash Player. That has now changed. Users must allow this separately each time a website wants to enable Flash content, regardless of whether they have done so in previous sessions.

In addition, Google has fixed 40 vulnerabilities in the browser that prevented an attacker from stealing or modifying data from other websites in the worst case scenario. Updating to Chrome 69.0.3497.81 will happen automatically on most systems. For Android users, Chrome 69.0.3497.76 has been made available.

1Password Password Manager Will Tighten Security

The popular password manager 1Password is security tightening after criticism from a Microsoft engineer. Engineer Dale Myers discovered the metadata for users, such as URLs, is stored unencrypted. A problem four years ago, even though it was reported.

For storage of data used 1Password two methods. The first is the AgileKeychain, which was followed by the OPVault in 2012. According to the developers 1Password possessed in the early days did not have enough computing power to decrypt and, for example searching logins. Because of these limitations, it was decided not to encrypt the URL and name of websites.

In 2012 the new OPVault format was launched, it offered more encryption. However, it was decided to upgrade users do not automatically safer this format, because users who use older versions of 1Password then not be able to access their accounts. Although AgileKeychain according to its developers is safe, it is now time to move on. Therefore OPVault the standard will be and there will be an automatic migration for all users.

1Password Password Manager Metadata Leaks

The popular Password manager 1Password appears to be leaking metadata from users, a problem that already in 2011 was noted. This time it's Microsoft engineer Dale Myers who discovered that metadata users is stored unencrypted.

1Password has a feature to support Dropbox synchronization between different devices. In addition to that store different files, including an unencrypted JavaScript file containing the names and addresses of all items stored in 1Password. This JavaScript file is accessible to third parties, warns the engineer.

"Anyone who change the link on the login page of me knows keychain can link and retrieve the file." This could especially be a problem for people with accounts for certain websites which they do not want others to know this. This problem only occurs when AgileKeychain format of 1Password and not the newer OPVault. Myers calls the developers of 1Password therefore to make this the only supported format.

In addition, Myers also presents another problem, which attackers can use the metadata to change a password if the user wants to reset his password, but not beyond the reset page has come. In this case, the reset link can be stored as metadata. The Microsoft engineer states that in 99% of cases is not a problem but in certain cases. The problem, according to Myers increased because some people link to their keychain to have on their website and in some cases is indexed by Google.

The developers of 1Password were informed by Myers, but let it be known that this was a deliberate design choice. In addition, the AgileKeychain is an older format in 2012 was replaced by OPVault. Still, Myers is also about critical, as when creating a OPVault on Mac OS X the user must provide a password hint to be stored unencrypted. Myers himself used 1Password for years. Through his findings in the Password Manager confidence is shaken. Yet he is not going to move.

Expert: Strong Password, Better Than Two-Factor Authentication

Regular security experts advise to set two-factor authentication in online accounts, which should be introduced additional code next to the password, but according to one expert, it is better to use only a strong password in combination with a password manager.

An example of two-factor authentication is a code sent by SMS and logging in, beside the password must be entered. If the user's password is stolen, the attacker can not join login here unless he has the phone user in his possession. Yet it according to security expert and researcher Egor Homakov not a panacea and its users better off with just a strong password.

Entering a second code when logging according Homakov namely waste of time. In addition, most codes are limited to six numbers, so that the second factor is too Brute Force. The measure does not stop malware and viruses, such as Bruce Schneier several years ago already announced. Furthermore, the expert that no plausible attack scenario is where a simple password, two-factor authentication is better than a strong password. An attacker who for example has the user's computer infected with malware can wait a few days until the user enters his second code somewhere.

In case an attacker to access a user's mailbox has, he can then reset the password. According Homakov it is therefore wiser to use a password manager that generates strong passwords, two-factor authentication. In addition, users should not have to ask or websites they are going to support two-factor authentication, but that option is added which allows the "forgot my password" option off.

Data LastPass Users Stolen By Hacking

Attackers have managed to break into the network of online password manager LastPass and there have stolen user data. These are e-mail addresses, reminders for passwords, user salts per server and authentication hashes.

LastPass is a popular cloud service where users their passwords for various websites and services in a "safe" to store. In a warning to users LastPass says it is confident that the measures encryption measures are sufficient to protect by far the most users. LastPass applies various measures to protect the authentication hash, making it difficult to retrieve the original password.

However, the company has announced additional measures. For example, users who log in from a new device or IP address first verify their account via e-mail unless multi-factor authentication is enabled. Also, users will be warned to change their master password. Furthermore, all users will be notified via e-mail. Since the encrypted "safe data" has not been captured, users their passwords to adjust not stored by LastPass.

Dropbox Prohibits 85,000 Words As Passwords

To prevent users from weak or easily guessed passwords choose Dropbox uses an extensive list of forbidden words. This was discovered by researcher Jerod Brennen by the Dropbox app to extract through the program 7-Zip. Both APK files on Android and iOS IPA files are really just zip files, in all but name. In the app, he found a file called pw.html, from what appeared to be 52 lines of JavaScript.

The script aims to prevent Dropbox users choose weak passwords when creating an account via the mobile app. The script uses a line with 85 100 banned words that should not be chosen as a password. These are words like password, computer and qwerty up of figures as 123456, 696969 and 111111 to combinations as abc123, passw0rd and 1234qwer. Also notable is the large number of obscene words that should not be selected. According Brennen that the online list has put, security professionals can add the word to their own lists and tools.