Slashdot Mirror

← Back to Stories (view on slashdot.org)

Google Storing WLAN Passwords In the Clear

Posted by timothy on from the memory-tricks dept.

First time accepted submitter husemann writes "Micah Lee from the EFF filed a bug report about Google storing all your WLAN passwords on their application settings backup service without allowing you to encrypt them. So far it's not known whether the passwords are stored encrypted at rest, but just the fact that Google can read them (and disclose them if forced by 'law') is a bit surprising, too put it nicely. Already one German university is concerned enough about this 'feature' that they issued a warning to their users."

6 of 242 comments (clear)

  1. Too much trust by Linux+User+33 · · Score: 5, Insightful

    I think this is perfect example again that we put too much trust on Google. They have repeatly broken that trust and yet some people continue to trust them. This data also goes directly to NSA and FBI. I think both FCC and European Commission should hit them hard, upto jailing the top executives.

    1. Re:Too much trust by gl4ss · · Score: 5, Funny

      you're wrong, they have time and time assured that the data doesn't go DIRECTLY to NSA. it goes through their servers, see, and they get to bill for it.

      --
      world was created 5 seconds before this post as it is.
  2. This is why I turned off backup by DigitAl56K · · Score: 5, Insightful

    I turned off Backup on Android after discovering this. They're going to have to store them in the clear (or I guess reversible), so that the "backup" is reversible - i.e. you recover your backup or add a new phone to your account and it "just works" with your wifi.

    However, there's no in-between. I can't choose to backup certain things but exclude very sensitive things, like my wifi password and other credentials. Given what we know about government snooping and the constant notices of breached databases these days, I just don't want to use the backup feature at all, and anyone who does is taking a bit of a gamble IMO.

    Can't we have a sub-option to "also include credentials", at the very least?

    1. Re:This is why I turned off backup by DigitAl56K · · Score: 5, Insightful

      But, I gotta ask ... if we don't trust Microsoft and Google, who is left?

      I am fine with trusting Microsoft and Google, and indeed anyone with a reliable infrastructure, to provide a backup hosting service that significantly improves the experience with my phone in the event of a disaster. I'm just not fine with entrusting them with access to the contents of those backups, especially when I may not even be aware of or have granular control over what is in them.

      A backup passphrase that only I know, and restricting processing to the client-side, would be sufficient to achieve this.

  3. Apple iOS by EkriirkE · · Score: 5, Interesting

    While not storing cleartext, they do store your WiFi passwords in a reversible encryption. If using WPA I think they should just store the ssid:phrase hash instead of keeping the phrase. WEP can't be helped... Anyhow, Apple stores all passwords in their keychain and this is easily snooped. Jailbroken iOS devices can get "WiFiPass" to reveal all the AP & passwords its ever connected to. It's handy when I pass my device to an AP owner to "privately" enter their password but I want to associate more devices, I just load that program and see what it was and do it myself.

    --
    from 09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0
    to 45 2F 6E 40 3C DF 10 71 4E 41 DF AA 25 7D 31 3F
  4. Situation may not be as it appears by Zontar_Thing_From_Ve · · Score: 5, Informative

    Looking at the comments in the first link in the original post is useful. One comment says that the only thing the panicked bug reporter knows is that the WLAN password was retrieved in the clear, but it could be that this information actually is encrypted but the retrieval decrypted it. In other words, things may not necessarily be as the original post and the bug reporter suggest. There is a chance that things are exactly as bad as suggested though. At this point only Google can say for sure how it is.