Microsoft reiterates that it’s totally fine with Edge storing passwords in cleartext, despite security researchers’ concerns
Microsoft Edge stores passwords in plaintext in device memory, according to a security researcher’s discovery this week. When questioned about the practice, Microsoft defended the decision as intentional design, stating that ‘Access to browser data as described in the reported scenario would require the device to already be compromised.’
The security concern centers on the fact that even multi-factor authentication protections could theoretically be bypassed if an attacker gained access to the affected machine and its terminal. While Microsoft’s argument has merit—device compromise is indeed a serious prerequisite for exploiting this vulnerability—security experts question whether the practice represents an unnecessary risk.
The company maintains that storing passwords in cleartext in memory is an acceptable security trade-off, given the high barrier to entry for potential attackers. However, the reaffirmation of this stance despite researcher concerns suggests Microsoft is unlikely to change the behavior in the near term. This approach to password security remains controversial in security circles, where best practices typically emphasize encrypting sensitive data at all times, regardless of the attack scenario required to access it.