Chrome's Insane Password Security Strategy

jones_supa writes "One day web developer Elliott Kember decided to switch from Safari to Chrome and in the process, discovered possibly a serious weakness with local password management in Chrome. The settings import tool forced the passwords to be always imported, which lead Kember to further investigate how the data can be accessed. For those who actually bother to look at the 'Saved passwords' page, it turns out that anyone with physical access can peek all the passwords in clear text very easily with a couple of mouse clicks. This spurred a lengthy discussion featuring Justin Schuh, the head of Chrome security, who says Kember is wrong and that this behavior of Chrome has been evaluated for years and is not going to change."

Comments

Re:This is also the case on Firefox

[robmv]

Firefox has the option to protect saved passwords with a master passwords and if you already unlocked the password store, in order to read password from the GUI, you need to unlock it again

Re:Firefox is the same

[Anonymous Coward]

../../Set Masterpassword

face it : chrome sucks at security, but that's no big surprise.

Re:This is also the case on Firefox

[gQuigs]

So set a Master Password: https://support.mozilla.org/en-US/kb/use-master-password-protect-stored-logins
More here: http://kb.mozillazine.org/Master_password

Almost no users actually use this: http://monica-at-mozilla.blogspot.com/2013/02/cant-live-with-them-cant-live-without.html
"....can be solved somewhat with master password, but only 1 out of 12K users had master password enabled"

Re:This is also the case on Firefox

[Spazmania]

From TFA:

The simple fact is that you need to lock your user account if you want to protect your information. If you don't do that, nothing else really matters because it's all just theater and won't actually stop anyone willing to invest minimal effort.

And there it is. The bottom line. Kember demands that Chrome engage in security theater and the Chrome authors said no. As they should.

Re:Firefox has done this for years

[The MAZZTer]

I don't think people realize that

1. The passwords are encrypted on disk.
2. The key for the encryption )on Windows at least) is the user's account... so Chrome can transparently decrypt them as long as you're logged in, for user convenience, though in this case it gives the appearance of not being encrypted.
3. Chrome MUST be able to store the passwords in a decryptable form so it can USE them, like you asked it to!

Re:This is also the case on Firefox

[AmiMoJo]

I just checked and Chrome keeps my passwords in a file under "C:\Users\\AppData\Local\Google\Chrome\User Data\Default". This directory is permission locked to me only. Even other admins can't access it unless they add permissions manually.

As far as I can tell Chrome does use filesystem level security to protect individual user's passwords.

Re:This is also the case on Firefox

[bmk67]

If only such a thing existed...

Oh, wait. It does.

http://lastpass.com/

Re:This is also the case on Firefox

[AliasBackslash]

LastPass does exactly this.

Re:Master Password (Thuderbird+Firefox)

[pthisis]

Exactly. Mozilla's email client Thunderbird also uses a Master Password to unlock the view-ability of the stored passwords.

Chrome uses the same core OS key storage that Firefox/Thunderbird does, and encrypts with the same master password--if I save a password in Firefox, it's available in Chrome and vice-versa. Both use kwallet on KDE, gnome-keyring on Gnome platforms, keychain access on the Mac, etc.

You can lock access to view them however the OS does so (e.g. with gnome, either Applications->Settings->Passwords and Keys, and select "Lock passwords", or from the command line, and gnome automatically locks them when your screensaver locks; on KDE it's the "Wallet Manager", I forget which menu it's under; on the Mac it's Utilities->Keychain Access, and click the little lock at the top of the keychain to lock/unlock). All 3 of those systems default to using your login password and automatically unlocking the keychain when you log in, but you can set the password separately (and be prompted to unlock it when you go to use it) if you want.

The problem here is that Windows' password management doesn't offer a reasonable alternative, but that's not Chrome's fault.

For those who insist on saying that chrome's security method is good enough consider this: How many people use separate log-in's for the "Family" computer that stays on most of the time? Not very many I'd imagine, just too much trouble for most to deal with. This means that both other family members as well as house guests can casually access all those passwords in no time.

a) Lock your passwords when you turn over the computer

b) You don't actually need to log in and out all the time to use separate accounts on the communal machine. Mine is usually sitting there logged into a guest account that everyone can use, with a browser running as the guest. I'll also use if I'm just looking something up on IMDB or googling/wiki'ing a quick question or whatever. There's a button on the menubar to "Run browser as..." with options for me and each of my family members, which prompts for the user's password and then runs a browser as them--if I need to check email or pay a bill or something, that browser's got my info but it's not available from the guest account/browser.. That covers the vast majority of cases, you just need to remember to close your browser when you're done with it.

For more complicated stuff, I pop over to VT8, log in, do what I need to do, and pop back. If I'm in the middle of something and someone needs to use the machine briefly, I can lock my terminal and switch back to the guest terminal for a few minutes, then switch back and unlock my screen without really disrupting anything.