4 ms·
Chrome stores them in sqlite as well. AFAIK on windows if running as the same user you just need to call CryptUnprotectData. No password needed. http://raiders
by kuroguro 8y ago
Chrome stores them in sqlite as well. AFAIK on windows if running as the same user you just need to call CryptUnprotectData. No password needed.
http://raidersec.blogspot.com/2013/06/how-browsers-store-your-passwords-and.html#chrome http://raidersec.blogspot.com/2013/06/how-browsers-store-you...
- garrettr_ 8y agoWindows’ OS keychain API is pretty weak, accessing secrets does not require user authorization. macOS and some Linux desktops environments do it slightly better, but there’s only so much you can do to defend against an attacker with the same privileges as the user.