Big Yikes: Microsoft Edge Caught Storing Passwords in Plaintext in Memory

What's up fellow keyboard smashers. If you're reading this on Microsoft Edge right now, you might want to pause and check if your accounts haven't been hijacked. The tech community is currently losing its collective mind over a massive security slip-up from Microsoft. Apparently, our fancy browser has been keeping our passwords in RAM, completely naked.

The TL;DR: What the actual f*ck, Microsoft?

The drama started when a security wizard on X (Twitter) named @L1v1ng0ffTh3L4N dropped a bombshell. They discovered that Microsoft Edge stores user passwords in the system's memory (RAM) in clear text.

The wild part? It doesn't just happen when you're actively typing or logging in. Even when those passwords are completely unused, they just chill in your RAM like an uninvited guest. What does this mean in plain English? If your rig gets infected with some basic malware that can dump system memory, congratulations! The hacker just got a free, unencrypted VIP pass to all your online accounts. No brute-forcing required.

Reddit & HN Out for Blood: "Enterprise-grade security, they said"

The thread blasted to the top of Hacker News with over 500 points. The comment section? An absolute warzone. Here's the breakdown from the trenches:

• The Firefox Supremacists: The open-source purists are having a field day. "Told you so," "Imagine not using Firefox in 2024," and "Time to nuke Edge" are the main vibes here.
• The Pragmatic Cynics: These guys argue the classic security law: "If malware has read access to your machine's memory, you're already screwed anyway." Which is true. If they are dumping your RAM, stealing your saved passwords is just the cherry on top of the disaster sundae.
• The Chromium Suspects: Some senior devs are trying to figure out if this is an Edge-specific f*ck up, or an underlying Chromium issue. If it's the latter, Chrome users might be sweating bullets right now.

The C4F Verdict: Clean up your damn memory

From a dev's perspective, this is a solid reminder of a basic principle that we often ignore because we're too lazy.

First off, memory management matters. When you're handling sensitive shit (passwords, tokens, API keys) in your code, zero out the buffers the moment you're done with them. Don't rely on garbage collectors to save your ass. They clear memory when they feel like it, not when you want them to. Secondly, as a user: Stop saving your passwords in your browser. Get a dedicated Password Manager (like Bitwarden). Browsers are built to eat your RAM and render HTML, they are not digital vaults.

Wrap up: Microsoft is probably whipping their devs right now to push a hotfix. Until then, grab some popcorn.

Source of the drama: Hacker News / Twitter