5 ms·

Someone will, of course, claim Google would never do this, but this presumably would make it trivial for Google itself to log into all of your accounts. In many

Someone will, of course, claim Google would never do this, but this presumably would make it trivial for Google itself to log into all of your accounts. In many cases they are already syncing a copy of your passwords.

gleenn 4y ago
It's 2FA so it would only get them half way there right?
- db3pt0 4y ago
  > In many cases they are already syncing a copy of your passwords. No, that gets them the full way there. They have your 2FA codes, and if you use Chrome and opt into it syncing passwords for you (passwords.google.com), this gives them both pieces of the puzzle.
  - cleanchit 4y ago
    If you use chrome, they could just download your cookies if they really wanted to.
hsbauauvhabzb 4y ago
I’d love it if google did this to me. I wouldn’t settle for anything less than a 9 figure payout.
- ocdtrekkie 4y ago
  Bear in mind, you would probably not see this as a covert/criminal act, but something sold as a feature. "Our artificial intelligence now can assist you by analyzing your transaction habits with your bank and can help manage your Facebook account." The sort of thing as a tech crowd would horrify many of us, but the public would largely go "oh neato".
judge2020 4y ago
Chrome passwords are encrypted with your password (just not e2ee) so it'd have to be a targeted attack where they log your password the next time you log in and then use that to decrypt your chrome passwords. Chrome also allows you to set your own sync passphrase different from your Google account password.
- NoZebra120vClip 4y ago
  Google says it's encrypted "with your Google account", not with your password. I don't know what the former means, but they do not say they're using your password to encrypt it.
londons_explore 4y ago
I hope someone has set up a honeypot by backing up a load of secrets with this service, and then seeing if anyone ever uses any of those secrets.

gleenn 4y ago

It's 2FA so it would only get them half way there right?

db3pt0 4y ago
> In many cases they are already syncing a copy of your passwords. No, that gets them the full way there. They have your 2FA codes, and if you use Chrome and opt into it syncing passwords for you (passwords.google.com), this gives them both pieces of the puzzle.
- cleanchit 4y ago
  If you use chrome, they could just download your cookies if they really wanted to.

hsbauauvhabzb 4y ago

I’d love it if google did this to me. I wouldn’t settle for anything less than a 9 figure payout.

ocdtrekkie 4y ago
Bear in mind, you would probably not see this as a covert/criminal act, but something sold as a feature. "Our artificial intelligence now can assist you by analyzing your transaction habits with your bank and can help manage your Facebook account." The sort of thing as a tech crowd would horrify many of us, but the public would largely go "oh neato".

judge2020 4y ago

Chrome passwords are encrypted with your password (just not e2ee) so it'd have to be a targeted attack where they log your password the next time you log in and then use that to decrypt your chrome passwords. Chrome also allows you to set your own sync passphrase different from your Google account password.

NoZebra120vClip 4y ago
Google says it's encrypted "with your Google account", not with your password. I don't know what the former means, but they do not say they're using your password to encrypt it.

londons_explore 4y ago

I hope someone has set up a honeypot by backing up a load of secrets with this service, and then seeing if anyone ever uses any of those secrets.