Microsoft reverses controversial Edge password design after backlash

Microsoft is pulling the plug on a controversial security flaw in Edge after a researcher exposed how it was storing user passwords in plaintext in RAM, raising security concerns and subsequent backlash that followed after the discovery.

Starting with version 148 of the browser, Edge will no longer load saved passwords into memory in cleartext at startup, effectively removing the risk of malware or malicious insiders siphoning credentials with minimal effort. The issue came to light when Norwegian security researcher Tom Jøran Sønstebyseter Rønning demonstrated that all stored Edge passwords were decrypted and loaded into memory as soon as the browser launched, even if they weren't actively being used.

Other Chromium-based browsers don't behave this way, and Rønning found Edge to be the only browser among those he tested that kept all passwords in plaintext at once. Microsoft initially defended the behavior, calling it a deliberate design choice. But with the public outcry and the potential for real-world exploitation, the company has seemingly reversed its course.

2

The change is now live in Edge 148, and users are advised to migrate their passwords to a more secure password manager to avoid future vulnerabilities. The incident highlights the growing scrutiny around browser security and how even major tech companies can make critical mistakes in credential management. With more users relying on built-in password managers, this fix is a necessary step, but it also raises more questions about what other potentially problematic design choices that might be hiding in plain sight.