4 ms·

Google's 'download all synced plaintext passwords as CSV' is a dangerous feature

11 points by weinzierl 5y ago

corobo 5y ago
Yeah, having all of your passwords in plain text is a dangerous action. Presumably this feature is for migrating between password managers and not so that you can just have your handy passwords.csv on the desktop though. [e: no need to presume it's right there highlighted in the screenshot]
UncleMeat 5y ago
Can't win. If you have a password management system that doesn't permit extracting your passwords to put into another service, people will complain that you are locking them in. And if you allow for extracting passwords people apparently complain about that. What is the single point of failure here? Malware on the machine or a compromised version of Chrome? Those would already be able to pwn you. Calling out "plaintext" is weird too. What are they supposed to give you, hashes? I'm excited to learn how a password manager that only stores hashes would work.
- szszrk 5y ago
  > What are they supposed to give you, hashes? Well, why not encrypted zip file, with password sent to cell phone? Google knows my cell quite well :) Or to alternative email.
  - atatatat 5y ago
    Or a letter to your home.
    - szszrk 5y ago
      Don't be childish. This is exactly what most services does, especially for sensitive actions, like going to account settings. 2FA is quite obvious and present, more and more services push it to users by default. > Or a letter to your home. What is even funnier in your comment is that Google actually sent physical letters (actual snail mail) with confirmation codes to be entered by a user via web. When confirming company address (and that you "own" that company on google maps, for instance. Large auction service on my local market did the same thing 17 years ago, to avoid scams... I think demanding 2FA confirmation for such a sensitive action like downloading all your passwords is perfectly justified.
buro9 5y ago
Took a moment for me to figure out that this is https://passwords.google.com/ https://passwords.google.com/ and seems to be surfaced natively in Chrome if you are signed in. I don't have a problem with a password export and I'm not sure anyone could but it is clear that for this to be offered as a smooth and convenient web-based experience that someone else holds the keys here. Your passwords may be safe in the possession of someone else and you feel that you trust them... but they do hold the keys to encrypting them and keeping them safe and that means that at some level they have access to your passwords. Which I guess means they could be requested by law enforcement with a warrant, etc. Whereas a dedicated password manager wherein you hold the encryption passphrase too would mean that the passwords are safe from any third party including the provider of the service. Export CSV isn't the dangerous feature, someone else holding the keys to your passwords is a dangerous feature. PS: I've probably missed some announcement that says this is actually super-secure and impossible for law enforcement to request with a valid warrant, etc... in which case please do share the announcement. It wasn't in the article, but this comment is longer than the article.
elaus 5y ago
On first thought plaintext passwords trigger all the "danger!" flags but I don't think Google is doing anything wrong here. Having the ability to export all stored passwords is a must for any password manager in my opinion. I always loved the way Google provides an easy and machine-readable data export that allows you to switch to other services if need be. That's a huge part of why even with all the criticism regarding the direction Google is heading to, I'm still using many of their services: I always have a recent copy of my data and can go somewhere else if things get too bad.

11 points by weinzierl 5y ago

Yeah, having all of your passwords in plain text is a dangerous action. Presumably this feature is for migrating between password managers and not so that you can just have your handy passwords.csv on the desktop though. [e: no need to presume it's right there highlighted in the screenshot]

UncleMeat 5y ago

Can't win. If you have a password management system that doesn't permit extracting your passwords to put into another service, people will complain that you are locking them in. And if you allow for extracting passwords people apparently complain about that. What is the single point of failure here? Malware on the machine or a compromised version of Chrome? Those would already be able to pwn you. Calling out "plaintext" is weird too. What are they supposed to give you, hashes? I'm excited to learn how a password manager that only stores hashes would work.

szszrk 5y ago
> What are they supposed to give you, hashes? Well, why not encrypted zip file, with password sent to cell phone? Google knows my cell quite well :) Or to alternative email.
- atatatat 5y ago
  Or a letter to your home.
  - szszrk 5y ago
    Don't be childish. This is exactly what most services does, especially for sensitive actions, like going to account settings. 2FA is quite obvious and present, more and more services push it to users by default. > Or a letter to your home. What is even funnier in your comment is that Google actually sent physical letters (actual snail mail) with confirmation codes to be entered by a user via web. When confirming company address (and that you "own" that company on google maps, for instance. Large auction service on my local market did the same thing 17 years ago, to avoid scams... I think demanding 2FA confirmation for such a sensitive action like downloading all your passwords is perfectly justified.

buro9 5y ago

Took a moment for me to figure out that this is https://passwords.google.com/ https://passwords.google.com/ and seems to be surfaced natively in Chrome if you are signed in. I don't have a problem with a password export and I'm not sure anyone could but it is clear that for this to be offered as a smooth and convenient web-based experience that someone else holds the keys here. Your passwords may be safe in the possession of someone else and you feel that you trust them... but they do hold the keys to encrypting them and keeping them safe and that means that at some level they have access to your passwords. Which I guess means they could be requested by law enforcement with a warrant, etc. Whereas a dedicated password manager wherein you hold the encryption passphrase too would mean that the passwords are safe from any third party including the provider of the service. Export CSV isn't the dangerous feature, someone else holding the keys to your passwords is a dangerous feature. PS: I've probably missed some announcement that says this is actually super-secure and impossible for law enforcement to request with a valid warrant, etc... in which case please do share the announcement. It wasn't in the article, but this comment is longer than the article.

elaus 5y ago

On first thought plaintext passwords trigger all the "danger!" flags but I don't think Google is doing anything wrong here. Having the ability to export all stored passwords is a must for any password manager in my opinion. I always loved the way Google provides an easy and machine-readable data export that allows you to switch to other services if need be. That's a huge part of why even with all the criticism regarding the direction Google is heading to, I'm still using many of their services: I always have a recent copy of my data and can go somewhere else if things get too bad.