Microsoft Edge Reverses Plaintext Password Storage After Backlash

Microsoft is reversing a design choice in its Edge browser that stored passwords in plaintext memory, a move prompted by significant backlash and security concerns. The company stated that this change addresses the issue immediately, with the updated behavior already present in the Canary release and slated for rollout to all stable versions.

Previously, a security researcher revealed that passwords stored by Edge could be extracted using a simple tool with administrator privileges. Microsoft initially defended the design, arguing that access to such data would require a compromised device and that the threat model excluded local attacks. However, public debate and lingering security worries led to the decision to implement the fix.

While Microsoft has not detailed the exact new method for storing and decrypting passwords, they have committed to improving their response to researcher reports. This action aligns with their broader commitment to security and customer feedback, aiming to bolster defenses against potential password exposure.