Chrome (browser) on Windows has credential theft bug

[steve2470]

https://www.theregister.co.uk/2017/05/17/chrome_on_windows_has_credential_theft_bug/

(yea this is geeky CHaS stuff but I thought this was important)

Google's Chrome team is working to fix a credential theft bug that strikes if the browser is running on Microsoft Windows.

The bug is exploited if a user is tricked into clicking a link that downloads a Windows .scf file (the ancient Shell Command File format, a shortcut to Show Desktop since Windows 98).

snip

While users wait for a fix from Google, Chrome users should get to their Advanced settings, and make Chrome ask where downloaded files are to be saved: that way, the .scf extension will be revealed.

Google told Kaspersky's ThreatPost it's aware of the issue and is working on a fix.

All geeky details at link.

[renate]

1. thanks!

Thank you for sharing this! I have no idea what any of that means (what's a credential theft? what's a scf file? ), but I did it anyway.

[steve2470]

2. my pleasure :) nt

[Eliot Rosewater]

3. Thanks for this

[Wounded Bear]

4. Thanks for posting...

Chrome user here. Will look into it.

[katmondoo]

5. I had Chrome on my last computer and hated it

I don't want to try it again, perhaps it helped crash my old PC. Maybe it was something else I really don't know but I am happy now and am afraid to change back to Chrome.

[Wounded Bear]

7. Works for me...

but I haven't had major issues.

[Demsrule86]

6. Thanks I fixed this...if you can't see your advanced settings...you can get them back with this.

Careful!

chrome://flags/