Slashdot Mirror
Chrome Can Tell You if Your Passwords Have Been Compromised (engadget.com)
An anonymous reader shares a report: Given the frequency of hacks and data leaks these days, chances are good at least one of your passwords has been released to the wild. A new Chrome extension released by Google today makes it a little easier to stay on top of that: Once installed, Password Checkup will simply sit in your Chrome browser and alert you if you enter a username / password combination that Google "knows to be unsafe." The company says it has a database of 4 billion credentials that have been compromised in various data breaches that it can check against. When the extension detects an insecure password, it'll prompt you with a big red dialog box to immediately update your info. It's handy, but users might wonder exactly what Google can see -- to that end, Google says that the extension "never reveal[s] this personal information."
The correct way to go about it would be to advise users if their password is on known data breaches whether it is associated with the username or not. Otherwise this extension could be used to mine credentials out of whatever database google is using.
How does it work? Does it keep a local database of 4 billion compromised credentials and checks against them? Or, let me guess, it uploads all of my passwords to a Google-controlled server to check if they are secure? Hmm, I wonder what could go wrong with this plan.
If it tells me where the UID/Pwd combo exist, I can then change someone's password for them? That could be useful....
"I do not agree with what you say, but I will defend to the death your right to say it"
Google *can* see everything you do with Chrome - every click, every keystroke, every image you linger on a bit longer than is seemly. That capability is well within their ability, aka they *can* do it. The real question is how much of that they *choose* to collect and send back home, rather than simply having the ability to do so.
This seems like it should be benign enough though - not much advantage to be gained collecting this information (and a lot of potential liability and bad PR), and it's simple enough to hash a name/password combination and send it back to the server in order to retrieve any/all pairs with a matching hash for comparison on your computer.
--- Most topics have many sides worth arguing, allow me to take one opposite you.
Google Security Blog Info.
Chrome Extension
If the universe is someone's simulation -- does that mean the stars are just stuck pixels?
I'll monitor my own shit thank you. I trust YOU (Google) even less than the bad guys.
Digital is, by definition, imperfect. Analog is the way to go.
It could just upload a hash of your password... but even so I would not want my username going up with even just a hash to anywhere but where I am logging in.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Only if your compromised credentials are in the database, in which case they already have them and nothing is gained by monitoring your query.
Besides which, the database is itself already publicly available on cracker sites, that's the point. Google is simply checking to see if your credentials are already public knowledge.
--- Most topics have many sides worth arguing, allow me to take one opposite you.