Im currently looking into the security of different browser password storing mechanisms. My main focus lies on the new Chromium based Microsoft Edge browser.
As far as I can see, Chromium based browsers use the system's credential manager / keychain to store passwords. On Windows that is the Credential Manager
, seemingly sometimes call Microsoft Vault
. To display or export passwords stored with Edge or other Chromium based browsers the user has to enter his password. Nevertheless if Firefox gets installed and triggers the import of passwords from the Edge browser no password is required. Further Firefox is not asking for the users account password in order to display passwords stored (prev. imported) in Firefox.
If host security measures, like Windows Defender and ATP are installed, dumping the passwords with tools like Mimikatz, Lazagne and CredMan (Powershell) seems impossible unless you find a way to circumvent the quite advanced protective measures.
Because the tools get blocked far before they want to access the Credential Store - but Firefox can import them with ease - I ask myself how it is doing that and how I could possibly reproduce that behaviour.
In general if Edge is storing the passwords in the Credential Manager and accessing it requires the user's password, how is another browser capable to import them without the user's password?