19 ms·

I'm the Chrome browser security tech lead, so it might help if I explain our reasoning here. The only strong permission boundary for your password storage is th

I'm the Chrome browser security tech lead, so it might help if I explain our reasoning here. The only strong permission boundary for your password storage is the OS user account. So, Chrome uses whatever encrypted storage the system provides to keep your passwords safe for a locked account. Beyond that, however, we've found that boundaries within the OS user account just aren't reliable, and are mostly just theater. Consider the case of someone malicious getting access to your account. Said bad guy can dump all your session cookies, grab your history, install malicious extension to intercept all your browsing activity, or install OS user account level monitoring software. My point is that once the bad guy got access to your account the game was lost, because there are just too many vectors for him to get what he wants. We've also been repeatedly asked why we don't just support a master password or something similar, even if we don't believe it works. We've debated it over and over again, but the conclusion we always come to is that we don't want to provide users with a false sense of security, and encourage risky behavior. We want to be very clear that when you grant someone access to your OS user account, that they can get at everything. Because in effect, that's really what they get.

niemand 13y ago
As you know, a system is only as secure as its weakest component. (Yes, everything is fundamentally broken and insecure, but that's no excuse for writing more crap software.) As a browser, it's impossible to secure all parts of the system (and that's not your job), but it's not okay to be the weakest component and not care about this. By virtue of providing a clear listing of all passwords and neither warning about this nor giving the user a choice, Chrome clearly is the weakest part in this. ----- From the source, it seems Chrome adds password using `SecKeychainAddInternetPassword` (see http://developer.apple.com/library/mac/documentation/Security/Reference/keychainservices/Reference/reference.html#//apple_ref/doc/c_ref/SecKeychainAddInternetPassword http://developer.apple.com/library/mac/documentation/Securit... ). Passwords added that way require confirmation for access, do not require entering the keychain password, and the application adding the password is auto-whitelisted (which overrides confirmation for access) -- which matches what I see on Chrome passwords. This means that the default way of creating internet passwords in the Keychain provides only weak security (sigh, Apple), because the creating application can always access the password. (Same applies to Safari, only it doesn't provide a nice list of passwords as far as I can tell.) ----- I agree that trying to add access control inside Chrome is nonsense – Chrome can access the passwords and you'll (probably) always be able to trick it into revealing things. But that's not the only thing you can do – it's relatively easy to fix the bad default behavior and disallow access for Chrome unless the user (via Keychain prompt) explicitly allows it. When storing a new password, offer to always require the keychain password for access. If the user chooses this option, use the lower-level API to create the entry (or use the default function and modify / add modified / delete old – there's code for that in the chrome repo) and use an ACL that has (1) an empty (but not NULL!) trusted application list, (2) the $blah_REQUIRE_PASSPHRASE bit in the prompt selector set. As a result, Chrome will not be able to access the password without the user explicitly allowing it. If the user always chooses the secure option when saving passwords, no one can access them without entering the keychain password or significantly mucking with the system. If that breaks, it's not your fault. That's a fundamentally different situation – it's hard to fail to protect passwords that you cannot access(^1)! (^1) at least not without other parts failing first
barrkel 13y ago
I use a master password with Firefox; part of the reason I don't use Chrome is because it doesn't have a similar feature. But this shows it's even worse than I thought. Security in depth. Encrypt the hard drive, encrypt the home directory, encrypt the browser password storage. You're basically advocating shallow security.
madaxe 13y ago
But it is a false sense of security. Joe User doesn't know a thing about how this magical box of tricks called a computer works. He just assumes that his data is safe on it, and won't get into the wrong hands, and that his passwords will always be protected by asterisks or what-not. Sure, you may encrypt them using keychain, which is good, and yes, if someone has physical access to their machine and user account then it's compromised, fundamentally - but you're missing the far more likely scenario that this could be used, by, say, an unscrupulous employer, or a mistrustful spouse, or a child to get at daddy's porn passwords. People re-use passwords. Yes, it's bad behaviour, but what do you expect from a shaved ape? By making it possible to view these, you could grant the keys to the kingdom to any would-be eavesdropper. It's not good. I understand your reasoning, but it's not connected to how people actually use their computers in reality.
- justinschuh 13y ago
  Soft boundaries within the user account do nothing to protect you from exactly those scenarios either. Your protection is to lock your OS user account.
  - madaxe 13y ago
    Yes, but by your reasoning, surely obfuscating passwords when inputted into websites is also pointless, yet you do do this in Chrome, which is inconsistent with your reasoning. I know, and you know, that locking one's account is the Thing To Do when not at one's terminal, but Joe User is still learning this, and in practice, most people do not lock their terminals when AFK, leaving them open to others in the household/dorm/school/office/whatever. Yes, locking the account is the user's responsibility, but it wouldn't hurt to help them out, by not making it possible to view all a user's passwords in their chrome preferences. Again, I'm aware that you could simply hop into keychain and check "show password", but this prompts for the user account password. At the very least, you should be doing the same.
    - justinschuh 13y ago
      > Yes, but by your reasoning, surely obfuscating passwords when inputted into websites is also pointless, yet you do do this in Chrome, which is inconsistent with your reasoning. Passwords are normally masked to prevent shoulder surfing, but the presumption is that the correct person is still at the keyboard. When you explicitly chose to show a password, the presumption is that you attempt to be aware of who is around you. If the bad guy is at the keyboard for your unlocked account, the fact is you've already lost. > Yes, locking the account is the user's responsibility, but it wouldn't hurt to help them out, by not making it possible to view all a user's passwords in their chrome preferences. This isn't about pushing responsibility off on the user. It's about not tricking users into believing they're safer than they actually are. > Again, I'm aware that you could simply hop into keychain and check "show password", but this prompts for the user account password. At the very least, you should be doing the same. If I'm an attacker, why would I use the keychain app to get Safari passwords? Just navigate to the site and change the auto-filled password field to text, or use an extension, or one of the many system-level approaches you have at your disposal. Many of these things are even available as tools that any novice can trivially acquire and use.
ds 13y ago
Nobody doubts that adding a master password will stop nobody who knows what they are doing. If someone has access to your computer and wants to do damage, they have full access to do it. However, keep in mind 'open door' syndrome. A crime of opportunity is very different than one of bad intentions. Leave a car unlocked with a $20 bill on the seat and you might find that $20 gone when you return. Now, if you lock the doors the odds are it will still be there when you return. The fact is that when you increase the barrier to doing evil, many give it up. A potentially honest person might open a door and take something but if they must now break a window to accomplish the same task many will not pursue it. Having to potentially download a third party program to decrypt the password DB and/or run additional commands is very different that just navigating to the chrome settings page. Its almost akin to why so many coworkers always jacked each others wallpaper when they forgot to lock their computer. They could have still done it even though the computer was locked, but they did not because it was too much work. Also, going off what you have said, the "locking" process in windows is pointless since it offers a false sense of security. It can be broken just by rebooting the computer with a boot disk, right? So why include it? Because its useful.
- izendejas 13y ago
  Completely agree here. This isn't about providing a sense of security as much as making it more difficult for co-workers or even friends to steal each other's passwords. Just because I forgot to lock the door of my house, doesn't mean I shouldn't be allowed to hide and secure some valuables I don't want stolen that easily.
  - kpop312 13y ago
    If chrome ever removes that setting, I will make chromereveal.com with one-click idiot-proof password dumping tool, and step-by step instructions. So hiding that button will not make it harder for your friends. Just logout and give them guest access...geez.
    - ronaldx 13y ago
      that does make it psychologically harder - I have to go to a site with clear malicious intention, rather than pay a visit to a setting which the browser itself provides.
marcgg 13y ago
I understand that a master password would just lead the user into a false sense of security. However, I feel that it should be make as hard as possible to find the user's password. A good safe is judged by the time required to break it. There is no safe that is unbreakable, you just need to put enough time, effort and noise to open it. Same thing could be applied here. Installing software, dump the cookies and so on requires time. Right now with this security a person could get my password in a couple of clicks with almost no technical knowledge. I'm not talking about a clever hacker, but rather a random person in a cafe with wifi asking someone if she could check her emails and steal the password while staying in Chrome. Again, it's not about making it impossible to retrieve, it's about making it a bit harder than just clicking the "show me the password" button. Of course I would never give physical access to my machine to anyone I don't trust. I always lock my computer when leaving it unattended... but I really doubt that anyone acts like that. It's a pretty geeky thing to do and the mainstream crowd isn't as worried by security. Let's say the master password solution isn't good because of the feeling of security it brings. Instead why not never show the password? Just say to the users it's stored on your system, but don't show it in plain text in Chrome. My point here is that there is little to no value (unless I'm missing something) to display the password in plain text, but there are some drawbacks (easy to see for semi-technical people). So why have this feature in the first place?
- corobo 13y ago
  "My point here is that there is little to no value" Personally speaking I've had plenty of occasions where I've logged into a site and saved the password then later Chrome doesn't recognise where to put the credentials on another page on the site (e.g. a header login vs a separate login page) - In those cases I'd rather just look to see what the password is and re-enter it than go through a password reset process.
  - phablet 13y ago
    Someone who can access your computer, unlocked, can login to your Facebook account (the password is saved), change the password, verify the email, re-save the new password, and it's just as easily "game over". You would never know what happened. Justin is absolutely right. His group is doing users a service by making these things more transparent. Folks who make exceptions based on this "security through obscurity" model should not be security tech leads.
PersonFace 13y ago
If the attacker is at the keyboard of your logged-in, not-screen-locked computer, you have definitely already lost. Regardless of the skill level of the attacker. If this attacker is your friend, co-worker, spouse, room-mate or the like, your problem is social and not technical. Those two points really should be obvious to everyone here. (This is a forum for software engineers, right?) It is safer (and more honest) to provide no security mechanism where none can work, than to provide a fake mechanism and then claim that it can work. Perhaps people are so mentally abused by decades of security snake-oil (e.g. anti-virus products) that they have come to accept snake-oil as the pinnacle of security engineering. I don't know how else to explain what is going on in this thread...
mkautzm 13y ago
I'm inclined to agree with Justin here. I mean, he's absolutely right in that if you have physical access, or if you have OS account access to a computer, it really doesn't matter what you do, your shit isn't safe any more. The argument of a 'crime of opportunity' doesn't play out in the digital world. Everything in the malware world is so automated and the scenario of 'If there are exposed passwords on this particular machine, I'll take them' just doesn't ever play out. To that end, while it certainly seems awkward from a 3rd party perspective, I'm kind of agree with Google on this one.
- interpol_p 13y ago
  That's not realistic. Do you work with your personal laptop in a work environment? I do. Sometimes you're debugging on a co-worker's machine and they step out of the room to get some water. This flaw makes it possible to read their web passwords in a manner which is not suspicious, quick, and not easy to trace. If it even took slightly longer, or there was a risk of being caught attached to this action it would be far less likely for someone to casually browse another's passwords.
- AdminUser 13y ago
  I would like to ask to think twice until agree Google's reply. And not only because they have so much power on the Internet. Think about most simplest case: childs John and Jack do their homework on Jack's computer. Jack goes to the toilet and John continue the writing/drawing. Then John gets "brilliand" idea: "Hmmm, why not stole his passwords all around and sell/play them later..." Is this something which you think never happen? There is two simple solution to avoid this: 1) Jack is having two accounts: admin and JackTheUser 2) There are no passwords in clear text format unless someone add JackTheUser's credentials. And this must happen everytime you look the passwords. #1 makes impossible to install any bad software #2 avoid simple friends to see your passwords Maybe Justin and Google just doesn't know how to verify user on the OS? Very same way than UAC behaved earlier on Windows. Some professionals call it layer security: if your front door is open, your safety box is still locked. May I ask, is that something which we do not want?
nazbot 13y ago
That's fair enough but then why put in a giant 'SHOW PASSWORD' button. Why not just remove that button. I expect a hacker using my computer with admin rights to get everything. I don't expect my GF to get my passwords simply by pressing the 'show passwords' button. And it's not very realistic for me to tell my GF she can't use my computer or to log out every time I give it to her. She's going to be kind of insulted if I do that. I just expect you guys to understand that in this day an age people DO actually share their computer with people without expecting them to have a giant 'SHOW PASSWORD' button in their favorite app.
- euyyn 13y ago
  > I expect a hacker using my computer with admin rights to get everything. Problem is a certain amount of people don't expect that, and it's important that this group doesn't grow.
kapowaz 13y ago
I wholeheartedly disagree with several of the points you make here, and I think you're more or less ‘passing the buck’ on something which is most definitely your responsibility to take good care with. On OS X, once you save a password using Safari, it is added to your login keychain. In order to then see that password* you must enter your login password again, be that via Safari's preferences dialog or the Keychain Access application. What Chrome does is it uses the same mechanism of storage as Safari (and indeed, requests access to the same encrypted keychain item) but never prompts the user for the login password to authenticate. This sets up a situation where Chrome actually circumvents and makes passwords originally stored in Safari less secure than they were initially. This is your responsibility, and no amount of theoretical grandstanding about physical access to a computer changes that. You also talk about installing malicious browser extensions as another potential vector. I agree, and I think browser makers ought to take steps to require the current user to authenticate in order to install browser extensions. When you consider that a browser extension can act as man-in-the-middle to all your browser activity, it's astonishing that this isn't already the case. You have to prove you are the logged-in user when you change your password by providing the current password, so how is this any different? When talking about security, there will always be holes, but they will be of differing practical value or risk depending on how they are exploited. Grabbing session cookies or internet history requires a certain level of technical proficiency, as does developing a malicious browser extension; installing said extension or typing chrome://settings/password into the address bar, on other hand, are easy enough that any kid who wants to get hold of his big sister's Facebook password can give it a go. Reducing the surface area of attack is every bit as important as ‘real’ security, here, and the stance you've set out above is that you aren't interested in that if it doesn't also provide real security. I think that's the wrong thing to do, and I urge you to reconsider. *As people have pointed out, you can inspect the password via web inspector etc. This is another, serious security flaw and one that I think the HTML WG ought to look into.
- anologwintermut 13y ago
  True, chrome circumvents safari's password security by merely querying the keychain without prompting for a password. What stops anything(or anyone) else from doing it? Absolutely nothing. You've fallen into exactly the trap they wanted to avoid. You assumed Safari's password security mechanism was more secure than it is. If chrome can access it without a password prompt, I can too. In fact, there's probably some nice apple script one liner to do it.
petehotchkiss 13y ago
Have to say Justin - your' doing an excellent impression of that Don Mattrick chap at M$. In case your memory is as bad as your ability to listen to what your products users are telling you; Don was the chap who when prompted on the new xbox DRM answered "if people want to play a games console thats not connected to the internet we already have a product for them - it's called the xbox360" Worth noting that he no longer works for M$.
bonaldi 13y ago
Yes, I can't believe people trusted those little gold locks on their diaries when they were teenagers. Didn't they know that someone malicious could just force that with a modicum of strength? Hiding passwords doesn't protect against someone malicious; it's enough of a speedbump to mean you don't need to be vigilant over all of your computers every second of every day. Say you have a party with your friends, and are playing music through your laptop. What if you want to use the bathroom? Do you have to lock your PC? Is leaving the room "risky behaviour"?
interpol_p 13y ago
You say you do not wish to lull users into a false sense of security. So why not clearly tell people each time Chrome saves a password that the saved password will be visible in plaintext by visiting chrome://settings/passwords ? Otherwise you are lulling people into a false sense of security. E.g., to view passwords in my coworker's Keychain, I have to at least enter their account password to show the plaintext. To view their web passwords (which probably overlap significantly with their Keychain) all I have to do is open Chrome. I often use my coworkers computers for minutes at a time, and they use mine. This flaw actually makes it possible to read their passwords — something not possible using other methods within seconds or minutes as they step out of the room.
- Shooti 13y ago
  "Inspect element" and then changing the "password" input type takes seconds/minutes.
  - interpol_p 13y ago
    Here are the issues with your method. - It's not as fast or inconspicuous as navigating to chrome://settings/passwords - It does not present all passwords in a single list with the ability to show the one I'm interested in - I would have to go to each site, allow Chrome to auto-fill, and then inspect the DOM and change the input type for each password I'm interested in. Far slower. - It feels far more malicious to do what you suggest. Feeling is important. If I feel like I'm doing something bad, I'm less likely to do it. If I feel like I'm innocently navigating the Chrome settings page then I'm more likely to take a peek at your passwords. - Far fewer people will be comfortable or familiar, or capable of using the DOM modification method. If a novice practices they are likely to get good at it. But that goes back to malicious intent.
    - epicgear 13y ago
      i'm surprised that you even answered him ...
- rmc 13y ago
jperrez 13y ago
OK, it is my fault to leave my laptop unlocked and I'm putting myself at risk by using a browser that let anyone to see my stored passwords in plain-text in a single click...
- corobo 13y ago
  Not sure if sarcasm.. Yes it is your fault if you forget to lock your account when you leave your machine unattended. It's also a click per password after the three clicks to get to that page.
  - Gootch 13y ago
    I just had to go take a piss though.. like really bad... I couldn't think... and by the time I got back, all my passwords were stolen by my sister's idiot friend... Wish my passwords were at least behind my Google Account username/password :/
AdminUser 13y ago
Please tell me why everything needs to be taken so seriously. You wrote: "...bad guy can dump all your session cookies, grab your history, install malicious extension to intercept all your browsing activity, or install OS user account level monitoring software..." It sounds like that computer owns nuclear bomb instructions. Take a breath and one step back: How about if the kids likes to play with their friend and likes to stole his/her facebook passwords when the friend is in the toilet (others are playing games at the same time with their friend's computer). Most of the kids do not think about dumping cookies, installing malicious extensions etc. They just like to look the password and use it later. We do not ask from you to provide any master password. Why not only ask user's credentials (the pure end user, not administrator credentials)? If I go to your computer while you are in toilet, can I come and change your password? Or can you agree that your following comment was not actually 100% correct: "...when you grant someone access to your OS user account, that they can get at everything..." At least mine OS: 1. Ask me the old password before I can change it. 2. I'm running normal end user credentials, so by default I do not have admin credentials. And by this way, I have very limited credentials to do what ever I like...
- euyyn 13y ago
  > It sounds like that computer owns nuclear bomb instructions. That computer, for many people, owns ways to access their online bank account. That's why Justin et al. need to take it so seriously.
itcmcgrath 13y ago
We also know bullet proof vests are not absolute protection, but you don't see the police/military throwing up their hands and not issuing and wearing them because 'someone determined could kill you anyway'. The point is that it would prevent a certain number of attacks (such as non technical mischievous people) from unpremeditated attacks. Your comment about 'false sense of security' is completely out of place as well. Chrome currently isn't doing anything to prevent the false sense of security (obviously from all the surprised people out there - can you see it now?). Why does it have to be a mutually exclusive choice? You could have your 'master password' and still have your false sense of security disclaimer displayed prominently next to it as well.
sdsdf 13y ago
Consider a case of some average user(who doesn't have the skills of your said bad guy) got on your computer while you are away, he can easily view your password to all your online account that's accessed on your browser.
NightFalcon 13y ago
Door locks are the same thing. Crooks can just break a window. Who cares which is easier! Door locks provide a false sense of security. For maximum effect, remove doorknobs to make sure people who can't even turn doorknobs can get in. Doorknobs provide a false sense of security. Oh to hell with it. We can't have people lulled into a false sense of security, and educating customers is bad for biz. Doors themselves must go as well. It's also key that we plant our feet on this issue regardless of what damn near every person on the planet would prefer: a deterrent against theft by someone unable or unwilling to break a window.
epicgear 13y ago
hmm.... i have a hard time agreeing with you justin. It's like saying once a thief is in your house, your game is lost anyways, so let's not put a lock on the door. You might be right on the point about the bad guy taking over the whole account and can do anything they want. But would it be a good thing for users if at least Chrome has strong password protection that makes the bad guy think twice about cracking them?
destiny14 13y ago
Justin, I don' t understand why you have to think only from a hacker' s point of view. Now this thing has got so much publicity that one of my colleagues in the office can simply come to my desk whilst I' m away to grab a coffee and steal my Facebook password? How simple is that and what are the implications?
Jayku1 13y ago
If Chrome uses "whatever encrypted storage the system provides" why aren't the credentials stored in the OSX keychain or the Windows Credential Manager, where the user has to re-enter their login password to see them...
Gootch 13y ago
If you're not going to protect people by implementing a simple master password mechinism (Google Account, on by default if you are logged in), you should at least warn people that saving their passwords is risky. The Chrome user interface doesn't let average users know their passwords are stored in such an easily accessible way. "Do you want to save your password?"... If they knew, it would 100% of the time be "Hell no!"... but Chrome asks by default, which puts millions of average users at risk... what a shame.
old_man 13y ago
Your customers are asking you to put a lock on that safe. Yet you keep telling them to go lock the front door. That's great, thanks for the reminder. I'll go use another safe that has extra security.
boyfriend 13y ago
This is so typical that the software designer looks at things only from the engineer perspective. Now I can see all the passwords my girlfriends saved in her chrome browser without me knowing any hacking knowledge. All I need is once in a while she didn't log out her browser account when she goes to restroom. God knows if any of those passwords is duplicate to the one she uses in online banking. You might argue that she doesn't log out the account exactly because she didn't know the threat of exposing her password by not logging out. But things like this happen, it just happen, everyday everywhere. Carelessness is in human nature. Now I get to know this issue because I check out Engadget from time to time. But I am sure my girlfriend doesn't. I am so sure that I can restrain my temptation of looking at her password when I love her. Hopefully we won't break up in the near future.
pouetalex 13y ago
From my office workstation, in this list I can read password of my personal NAS that I only access from home. Does it means that all these passwords are stored in my Google Account ? Does it means that applying steps below is possible ? 1. Steal Google credentials : By using phishing or simply access the password Chrome page of an unmonitored screen (it only requires 10 seconds), 2. On a other system, use the stolen Google credentials to connect on an blank Chrome installation, 3. Open the password list page, and get access to all the passwords registered in the Google Account. If it works, it provides a long term remote access to all the passwords stored on the targeted Google Account. Even if the targeted user changes the stored passwords (Facebook, ...), as long as it stores them on Chrome and does not change its Google password, I can get all the password changes. Please, tell me that I missed something, and that I am wrong ...
lurkertech 13y ago
I would like to suggest another solution to this problem that can make everyone happy. The goals are clear: GOAL 1. avoid giving the user a "false sense of security" GOAL 2. give the user the best security/convenience tradeoff for her particular needs The current Chrome behavior fails to achieve GOAL 1 because the user is not informed about the lenient "Show Passwords" behavior (as many posters here noted), nor is she informed about how vulnerable she is when someone has access to her local login account (as Justin described). Avoiding a "false sense of security" really means helping to educate the user, and Chrome has failed to educate the user. Only the user knows what threats she needs to defend against (is it just a naughty little sister at home or a tech-savvy corporate spy breaking into her work computer?). Chrome should inform the user so she can make a choice that is in her interest. Nearly everyone in this thread is assuming that Chrome has to make the security/convenience tradeoff choice for the user. But Chrome can satisfy GOAL 2 by offering a few options. My proposal is that Chrome should present the user with a few clear choices in plain English with realistic explanations of the advantages and disadvantages of each, and the user can then pick her own security/convenience tradeoff. Let me give some suggested text to get the discussion going. I will suggest three specific behaviors to choose from, but these are just examples. Chrome engineers may decide on a different set of behaviors to offer (perhaps even still only one choice). The point is that the user MUST be presented with choices in plain English that give her enough information to avoid any "false sense of security." Even if Chrome offers no choices, Chrome MUST still inform the user about what she is getting when she chooses to save passwords. I suggest that after the user has just installed Chrome and she clicks to save her first password, she should be presented with the following choice (the choice will then persist until and unless she changes it Chrome settings): -------- BEGIN SUGGESTED TEXT ------------- Saved Passwords Security Please choose how you would like Chrome to restrict access to your saved passwords: CHOICE 1: No security: You or anyone sitting at your computer can view saved passwords at any time in the "Managed Saved Passwords" screen of Chrome settings. This option is the most convenient, but the least secure. If you use this option, consider locking your computer every time you leave it so that others cannot view your passwords. CHOICE 2: Master Password to view passwords only: Chrome will ask you to create a Master Password. You must type the Master Password whenever you want to view your saved passwords in the "Managed Saved Passwords" screen of Chrome settings. But you do not need to type your Master Password in order for Chrome to fill passwords into websites you visit. This option can prevent casual, non-technical users from seeing your passwords (e.g. practical jokes from siblings or coworkers), but it does not offer any meaningful security barrier to an even mildly technical user who has gotten access to your account on your computer. CHOICE 3: Master Password to view or use passwords: Chrome will ask you to create a Master Password. You must type the Master Password whenever you want to view your saved passwords in the "Managed Saved Passwords" screen of Chrome settings, AND you must type the Master Password every time Chrome is about to fill a password into a website that you visit. This option is the least convenient, but it offers a significantly higher barrier to a malicious, technical user who has gotten access to your account on your computer. Please be aware that none of these options offer complete protection in the event that a malicious user (or malware) has gotten access to your account on your computer. For example, such a user can always examine your history or install malicious plugins to track your browsing activity, even if you never save any passwords. These Saved Password Security options simply let you choose from amongst practically available tradeoffs of security and convenience. -------- END SUGGESTED TEXT ------------- In this suggestion, I have provided a #3 option which assumes that, under the hood, Chrome would NEVER store the Master Password in core or on disk, except during the short interval between when the user is prompted for it and when it is used to decrypt the website password. There is NOTHING magical about option #3 that offers 100% security. It is simply a higher barrier for bad guys to jump over (they have to hack into the binary's core at a particular moment to get the Master Password, or use other attacks not related to saved passwords). Option #3 may possibly be too inconvenient for anyone to choose: maybe a "sudo" timeout option is better, with different security/convenience tradeoffs. We can discuss all that.... But the main point is that Chrome must do a better job of informing the user about whatever behaviors it offers, and only then can Chrome truly avoid a "false sense of security."
tonyff 13y ago
By your argument users should not be prompted for their current password to change their password as that would provide them with a false sense of security. Or I guess now that they can just go and look up your password and then login and change it on the site they would not even need to do that. Security fail. You've set the bar way way way to low for easy compromise in seconds with no technical knowledge of computers needed.

niemand 13y ago

As you know, a system is only as secure as its weakest component. (Yes, everything is fundamentally broken and insecure, but that's no excuse for writing more crap software.) As a browser, it's impossible to secure all parts of the system (and that's not your job), but it's not okay to be the weakest component and not care about this. By virtue of providing a clear listing of all passwords and neither warning about this nor giving the user a choice, Chrome clearly is the weakest part in this. ----- From the source, it seems Chrome adds password using `SecKeychainAddInternetPassword` (see http://developer.apple.com/library/mac/documentation/Security/Reference/keychainservices/Reference/reference.html#//apple_ref/doc/c_ref/SecKeychainAddInternetPassword http://developer.apple.com/library/mac/documentation/Securit... ). Passwords added that way require confirmation for access, do not require entering the keychain password, and the application adding the password is auto-whitelisted (which overrides confirmation for access) -- which matches what I see on Chrome passwords. This means that the default way of creating internet passwords in the Keychain provides only weak security (sigh, Apple), because the creating application can always access the password. (Same applies to Safari, only it doesn't provide a nice list of passwords as far as I can tell.) ----- I agree that trying to add access control inside Chrome is nonsense – Chrome can access the passwords and you'll (probably) always be able to trick it into revealing things. But that's not the only thing you can do – it's relatively easy to fix the bad default behavior and disallow access for Chrome unless the user (via Keychain prompt) explicitly allows it. When storing a new password, offer to always require the keychain password for access. If the user chooses this option, use the lower-level API to create the entry (or use the default function and modify / add modified / delete old – there's code for that in the chrome repo) and use an ACL that has (1) an empty (but not NULL!) trusted application list, (2) the $blah_REQUIRE_PASSPHRASE bit in the prompt selector set. As a result, Chrome will not be able to access the password without the user explicitly allowing it. If the user always chooses the secure option when saving passwords, no one can access them without entering the keychain password or significantly mucking with the system. If that breaks, it's not your fault. That's a fundamentally different situation – it's hard to fail to protect passwords that you cannot access(^1)! (^1) at least not without other parts failing first

barrkel 13y ago

I use a master password with Firefox; part of the reason I don't use Chrome is because it doesn't have a similar feature. But this shows it's even worse than I thought. Security in depth. Encrypt the hard drive, encrypt the home directory, encrypt the browser password storage. You're basically advocating shallow security.

madaxe 13y ago

But it is a false sense of security. Joe User doesn't know a thing about how this magical box of tricks called a computer works. He just assumes that his data is safe on it, and won't get into the wrong hands, and that his passwords will always be protected by asterisks or what-not. Sure, you may encrypt them using keychain, which is good, and yes, if someone has physical access to their machine and user account then it's compromised, fundamentally - but you're missing the far more likely scenario that this could be used, by, say, an unscrupulous employer, or a mistrustful spouse, or a child to get at daddy's porn passwords. People re-use passwords. Yes, it's bad behaviour, but what do you expect from a shaved ape? By making it possible to view these, you could grant the keys to the kingdom to any would-be eavesdropper. It's not good. I understand your reasoning, but it's not connected to how people actually use their computers in reality.

justinschuh 13y ago
Soft boundaries within the user account do nothing to protect you from exactly those scenarios either. Your protection is to lock your OS user account.
- madaxe 13y ago
  Yes, but by your reasoning, surely obfuscating passwords when inputted into websites is also pointless, yet you do do this in Chrome, which is inconsistent with your reasoning. I know, and you know, that locking one's account is the Thing To Do when not at one's terminal, but Joe User is still learning this, and in practice, most people do not lock their terminals when AFK, leaving them open to others in the household/dorm/school/office/whatever. Yes, locking the account is the user's responsibility, but it wouldn't hurt to help them out, by not making it possible to view all a user's passwords in their chrome preferences. Again, I'm aware that you could simply hop into keychain and check "show password", but this prompts for the user account password. At the very least, you should be doing the same.
  - justinschuh 13y ago
    > Yes, but by your reasoning, surely obfuscating passwords when inputted into websites is also pointless, yet you do do this in Chrome, which is inconsistent with your reasoning. Passwords are normally masked to prevent shoulder surfing, but the presumption is that the correct person is still at the keyboard. When you explicitly chose to show a password, the presumption is that you attempt to be aware of who is around you. If the bad guy is at the keyboard for your unlocked account, the fact is you've already lost. > Yes, locking the account is the user's responsibility, but it wouldn't hurt to help them out, by not making it possible to view all a user's passwords in their chrome preferences. This isn't about pushing responsibility off on the user. It's about not tricking users into believing they're safer than they actually are. > Again, I'm aware that you could simply hop into keychain and check "show password", but this prompts for the user account password. At the very least, you should be doing the same. If I'm an attacker, why would I use the keychain app to get Safari passwords? Just navigate to the site and change the auto-filled password field to text, or use an extension, or one of the many system-level approaches you have at your disposal. Many of these things are even available as tools that any novice can trivially acquire and use.

ds 13y ago

Nobody doubts that adding a master password will stop nobody who knows what they are doing. If someone has access to your computer and wants to do damage, they have full access to do it. However, keep in mind 'open door' syndrome. A crime of opportunity is very different than one of bad intentions. Leave a car unlocked with a $20 bill on the seat and you might find that $20 gone when you return. Now, if you lock the doors the odds are it will still be there when you return. The fact is that when you increase the barrier to doing evil, many give it up. A potentially honest person might open a door and take something but if they must now break a window to accomplish the same task many will not pursue it. Having to potentially download a third party program to decrypt the password DB and/or run additional commands is very different that just navigating to the chrome settings page. Its almost akin to why so many coworkers always jacked each others wallpaper when they forgot to lock their computer. They could have still done it even though the computer was locked, but they did not because it was too much work. Also, going off what you have said, the "locking" process in windows is pointless since it offers a false sense of security. It can be broken just by rebooting the computer with a boot disk, right? So why include it? Because its useful.

izendejas 13y ago
Completely agree here. This isn't about providing a sense of security as much as making it more difficult for co-workers or even friends to steal each other's passwords. Just because I forgot to lock the door of my house, doesn't mean I shouldn't be allowed to hide and secure some valuables I don't want stolen that easily.
- kpop312 13y ago
  If chrome ever removes that setting, I will make chromereveal.com with one-click idiot-proof password dumping tool, and step-by step instructions. So hiding that button will not make it harder for your friends. Just logout and give them guest access...geez.
  - ronaldx 13y ago
    that does make it psychologically harder - I have to go to a site with clear malicious intention, rather than pay a visit to a setting which the browser itself provides.

marcgg 13y ago

I understand that a master password would just lead the user into a false sense of security. However, I feel that it should be make as hard as possible to find the user's password. A good safe is judged by the time required to break it. There is no safe that is unbreakable, you just need to put enough time, effort and noise to open it. Same thing could be applied here. Installing software, dump the cookies and so on requires time. Right now with this security a person could get my password in a couple of clicks with almost no technical knowledge. I'm not talking about a clever hacker, but rather a random person in a cafe with wifi asking someone if she could check her emails and steal the password while staying in Chrome. Again, it's not about making it impossible to retrieve, it's about making it a bit harder than just clicking the "show me the password" button. Of course I would never give physical access to my machine to anyone I don't trust. I always lock my computer when leaving it unattended... but I really doubt that anyone acts like that. It's a pretty geeky thing to do and the mainstream crowd isn't as worried by security. Let's say the master password solution isn't good because of the feeling of security it brings. Instead why not never show the password? Just say to the users it's stored on your system, but don't show it in plain text in Chrome. My point here is that there is little to no value (unless I'm missing something) to display the password in plain text, but there are some drawbacks (easy to see for semi-technical people). So why have this feature in the first place?

corobo 13y ago
"My point here is that there is little to no value" Personally speaking I've had plenty of occasions where I've logged into a site and saved the password then later Chrome doesn't recognise where to put the credentials on another page on the site (e.g. a header login vs a separate login page) - In those cases I'd rather just look to see what the password is and re-enter it than go through a password reset process.
- phablet 13y ago
  Someone who can access your computer, unlocked, can login to your Facebook account (the password is saved), change the password, verify the email, re-save the new password, and it's just as easily "game over". You would never know what happened. Justin is absolutely right. His group is doing users a service by making these things more transparent. Folks who make exceptions based on this "security through obscurity" model should not be security tech leads.

PersonFace 13y ago

If the attacker is at the keyboard of your logged-in, not-screen-locked computer, you have definitely already lost. Regardless of the skill level of the attacker. If this attacker is your friend, co-worker, spouse, room-mate or the like, your problem is social and not technical. Those two points really should be obvious to everyone here. (This is a forum for software engineers, right?) It is safer (and more honest) to provide no security mechanism where none can work, than to provide a fake mechanism and then claim that it can work. Perhaps people are so mentally abused by decades of security snake-oil (e.g. anti-virus products) that they have come to accept snake-oil as the pinnacle of security engineering. I don't know how else to explain what is going on in this thread...

mkautzm 13y ago

I'm inclined to agree with Justin here. I mean, he's absolutely right in that if you have physical access, or if you have OS account access to a computer, it really doesn't matter what you do, your shit isn't safe any more. The argument of a 'crime of opportunity' doesn't play out in the digital world. Everything in the malware world is so automated and the scenario of 'If there are exposed passwords on this particular machine, I'll take them' just doesn't ever play out. To that end, while it certainly seems awkward from a 3rd party perspective, I'm kind of agree with Google on this one.

interpol_p 13y ago
That's not realistic. Do you work with your personal laptop in a work environment? I do. Sometimes you're debugging on a co-worker's machine and they step out of the room to get some water. This flaw makes it possible to read their web passwords in a manner which is not suspicious, quick, and not easy to trace. If it even took slightly longer, or there was a risk of being caught attached to this action it would be far less likely for someone to casually browse another's passwords.
AdminUser 13y ago
I would like to ask to think twice until agree Google's reply. And not only because they have so much power on the Internet. Think about most simplest case: childs John and Jack do their homework on Jack's computer. Jack goes to the toilet and John continue the writing/drawing. Then John gets "brilliand" idea: "Hmmm, why not stole his passwords all around and sell/play them later..." Is this something which you think never happen? There is two simple solution to avoid this: 1) Jack is having two accounts: admin and JackTheUser 2) There are no passwords in clear text format unless someone add JackTheUser's credentials. And this must happen everytime you look the passwords. #1 makes impossible to install any bad software #2 avoid simple friends to see your passwords Maybe Justin and Google just doesn't know how to verify user on the OS? Very same way than UAC behaved earlier on Windows. Some professionals call it layer security: if your front door is open, your safety box is still locked. May I ask, is that something which we do not want?

nazbot 13y ago

That's fair enough but then why put in a giant 'SHOW PASSWORD' button. Why not just remove that button. I expect a hacker using my computer with admin rights to get everything. I don't expect my GF to get my passwords simply by pressing the 'show passwords' button. And it's not very realistic for me to tell my GF she can't use my computer or to log out every time I give it to her. She's going to be kind of insulted if I do that. I just expect you guys to understand that in this day an age people DO actually share their computer with people without expecting them to have a giant 'SHOW PASSWORD' button in their favorite app.

euyyn 13y ago
> I expect a hacker using my computer with admin rights to get everything. Problem is a certain amount of people don't expect that, and it's important that this group doesn't grow.

kapowaz 13y ago

I wholeheartedly disagree with several of the points you make here, and I think you're more or less ‘passing the buck’ on something which is most definitely your responsibility to take good care with. On OS X, once you save a password using Safari, it is added to your login keychain. In order to then see that password* you must enter your login password again, be that via Safari's preferences dialog or the Keychain Access application. What Chrome does is it uses the same mechanism of storage as Safari (and indeed, requests access to the same encrypted keychain item) but never prompts the user for the login password to authenticate. This sets up a situation where Chrome actually circumvents and makes passwords originally stored in Safari less secure than they were initially. This is your responsibility, and no amount of theoretical grandstanding about physical access to a computer changes that. You also talk about installing malicious browser extensions as another potential vector. I agree, and I think browser makers ought to take steps to require the current user to authenticate in order to install browser extensions. When you consider that a browser extension can act as man-in-the-middle to all your browser activity, it's astonishing that this isn't already the case. You have to prove you are the logged-in user when you change your password by providing the current password, so how is this any different? When talking about security, there will always be holes, but they will be of differing practical value or risk depending on how they are exploited. Grabbing session cookies or internet history requires a certain level of technical proficiency, as does developing a malicious browser extension; installing said extension or typing chrome://settings/password into the address bar, on other hand, are easy enough that any kid who wants to get hold of his big sister's Facebook password can give it a go. Reducing the surface area of attack is every bit as important as ‘real’ security, here, and the stance you've set out above is that you aren't interested in that if it doesn't also provide real security. I think that's the wrong thing to do, and I urge you to reconsider. *As people have pointed out, you can inspect the password via web inspector etc. This is another, serious security flaw and one that I think the HTML WG ought to look into.

anologwintermut 13y ago
True, chrome circumvents safari's password security by merely querying the keychain without prompting for a password. What stops anything(or anyone) else from doing it? Absolutely nothing. You've fallen into exactly the trap they wanted to avoid. You assumed Safari's password security mechanism was more secure than it is. If chrome can access it without a password prompt, I can too. In fact, there's probably some nice apple script one liner to do it.

petehotchkiss 13y ago

Have to say Justin - your' doing an excellent impression of that Don Mattrick chap at M$. In case your memory is as bad as your ability to listen to what your products users are telling you; Don was the chap who when prompted on the new xbox DRM answered "if people want to play a games console thats not connected to the internet we already have a product for them - it's called the xbox360" Worth noting that he no longer works for M$.

bonaldi 13y ago

Yes, I can't believe people trusted those little gold locks on their diaries when they were teenagers. Didn't they know that someone malicious could just force that with a modicum of strength? Hiding passwords doesn't protect against someone malicious; it's enough of a speedbump to mean you don't need to be vigilant over all of your computers every second of every day. Say you have a party with your friends, and are playing music through your laptop. What if you want to use the bathroom? Do you have to lock your PC? Is leaving the room "risky behaviour"?

interpol_p 13y ago

You say you do not wish to lull users into a false sense of security. So why not clearly tell people each time Chrome saves a password that the saved password will be visible in plaintext by visiting chrome://settings/passwords ? Otherwise you are lulling people into a false sense of security. E.g., to view passwords in my coworker's Keychain, I have to at least enter their account password to show the plaintext. To view their web passwords (which probably overlap significantly with their Keychain) all I have to do is open Chrome. I often use my coworkers computers for minutes at a time, and they use mine. This flaw actually makes it possible to read their passwords — something not possible using other methods within seconds or minutes as they step out of the room.

Shooti 13y ago
"Inspect element" and then changing the "password" input type takes seconds/minutes.
- interpol_p 13y ago
  Here are the issues with your method. - It's not as fast or inconspicuous as navigating to chrome://settings/passwords - It does not present all passwords in a single list with the ability to show the one I'm interested in - I would have to go to each site, allow Chrome to auto-fill, and then inspect the DOM and change the input type for each password I'm interested in. Far slower. - It feels far more malicious to do what you suggest. Feeling is important. If I feel like I'm doing something bad, I'm less likely to do it. If I feel like I'm innocently navigating the Chrome settings page then I'm more likely to take a peek at your passwords. - Far fewer people will be comfortable or familiar, or capable of using the DOM modification method. If a novice practices they are likely to get good at it. But that goes back to malicious intent.
  - epicgear 13y ago
    i'm surprised that you even answered him ...
rmc 13y ago

jperrez 13y ago

OK, it is my fault to leave my laptop unlocked and I'm putting myself at risk by using a browser that let anyone to see my stored passwords in plain-text in a single click...

corobo 13y ago
Not sure if sarcasm.. Yes it is your fault if you forget to lock your account when you leave your machine unattended. It's also a click per password after the three clicks to get to that page.
- Gootch 13y ago
  I just had to go take a piss though.. like really bad... I couldn't think... and by the time I got back, all my passwords were stolen by my sister's idiot friend... Wish my passwords were at least behind my Google Account username/password :/

AdminUser 13y ago

Please tell me why everything needs to be taken so seriously. You wrote: "...bad guy can dump all your session cookies, grab your history, install malicious extension to intercept all your browsing activity, or install OS user account level monitoring software..." It sounds like that computer owns nuclear bomb instructions. Take a breath and one step back: How about if the kids likes to play with their friend and likes to stole his/her facebook passwords when the friend is in the toilet (others are playing games at the same time with their friend's computer). Most of the kids do not think about dumping cookies, installing malicious extensions etc. They just like to look the password and use it later. We do not ask from you to provide any master password. Why not only ask user's credentials (the pure end user, not administrator credentials)? If I go to your computer while you are in toilet, can I come and change your password? Or can you agree that your following comment was not actually 100% correct: "...when you grant someone access to your OS user account, that they can get at everything..." At least mine OS: 1. Ask me the old password before I can change it. 2. I'm running normal end user credentials, so by default I do not have admin credentials. And by this way, I have very limited credentials to do what ever I like...

euyyn 13y ago
> It sounds like that computer owns nuclear bomb instructions. That computer, for many people, owns ways to access their online bank account. That's why Justin et al. need to take it so seriously.

itcmcgrath 13y ago

We also know bullet proof vests are not absolute protection, but you don't see the police/military throwing up their hands and not issuing and wearing them because 'someone determined could kill you anyway'. The point is that it would prevent a certain number of attacks (such as non technical mischievous people) from unpremeditated attacks. Your comment about 'false sense of security' is completely out of place as well. Chrome currently isn't doing anything to prevent the false sense of security (obviously from all the surprised people out there - can you see it now?). Why does it have to be a mutually exclusive choice? You could have your 'master password' and still have your false sense of security disclaimer displayed prominently next to it as well.

sdsdf 13y ago

Consider a case of some average user(who doesn't have the skills of your said bad guy) got on your computer while you are away, he can easily view your password to all your online account that's accessed on your browser.

NightFalcon 13y ago

Door locks are the same thing. Crooks can just break a window. Who cares which is easier! Door locks provide a false sense of security. For maximum effect, remove doorknobs to make sure people who can't even turn doorknobs can get in. Doorknobs provide a false sense of security. Oh to hell with it. We can't have people lulled into a false sense of security, and educating customers is bad for biz. Doors themselves must go as well. It's also key that we plant our feet on this issue regardless of what damn near every person on the planet would prefer: a deterrent against theft by someone unable or unwilling to break a window.

epicgear 13y ago

hmm.... i have a hard time agreeing with you justin. It's like saying once a thief is in your house, your game is lost anyways, so let's not put a lock on the door. You might be right on the point about the bad guy taking over the whole account and can do anything they want. But would it be a good thing for users if at least Chrome has strong password protection that makes the bad guy think twice about cracking them?

destiny14 13y ago

Justin, I don' t understand why you have to think only from a hacker' s point of view. Now this thing has got so much publicity that one of my colleagues in the office can simply come to my desk whilst I' m away to grab a coffee and steal my Facebook password? How simple is that and what are the implications?

Jayku1 13y ago

If Chrome uses "whatever encrypted storage the system provides" why aren't the credentials stored in the OSX keychain or the Windows Credential Manager, where the user has to re-enter their login password to see them...

Gootch 13y ago

If you're not going to protect people by implementing a simple master password mechinism (Google Account, on by default if you are logged in), you should at least warn people that saving their passwords is risky. The Chrome user interface doesn't let average users know their passwords are stored in such an easily accessible way. "Do you want to save your password?"... If they knew, it would 100% of the time be "Hell no!"... but Chrome asks by default, which puts millions of average users at risk... what a shame.

old_man 13y ago

Your customers are asking you to put a lock on that safe. Yet you keep telling them to go lock the front door. That's great, thanks for the reminder. I'll go use another safe that has extra security.

boyfriend 13y ago

This is so typical that the software designer looks at things only from the engineer perspective. Now I can see all the passwords my girlfriends saved in her chrome browser without me knowing any hacking knowledge. All I need is once in a while she didn't log out her browser account when she goes to restroom. God knows if any of those passwords is duplicate to the one she uses in online banking. You might argue that she doesn't log out the account exactly because she didn't know the threat of exposing her password by not logging out. But things like this happen, it just happen, everyday everywhere. Carelessness is in human nature. Now I get to know this issue because I check out Engadget from time to time. But I am sure my girlfriend doesn't. I am so sure that I can restrain my temptation of looking at her password when I love her. Hopefully we won't break up in the near future.

pouetalex 13y ago

From my office workstation, in this list I can read password of my personal NAS that I only access from home. Does it means that all these passwords are stored in my Google Account ? Does it means that applying steps below is possible ? 1. Steal Google credentials : By using phishing or simply access the password Chrome page of an unmonitored screen (it only requires 10 seconds), 2. On a other system, use the stolen Google credentials to connect on an blank Chrome installation, 3. Open the password list page, and get access to all the passwords registered in the Google Account. If it works, it provides a long term remote access to all the passwords stored on the targeted Google Account. Even if the targeted user changes the stored passwords (Facebook, ...), as long as it stores them on Chrome and does not change its Google password, I can get all the password changes. Please, tell me that I missed something, and that I am wrong ...

lurkertech 13y ago

I would like to suggest another solution to this problem that can make everyone happy. The goals are clear: GOAL 1. avoid giving the user a "false sense of security" GOAL 2. give the user the best security/convenience tradeoff for her particular needs The current Chrome behavior fails to achieve GOAL 1 because the user is not informed about the lenient "Show Passwords" behavior (as many posters here noted), nor is she informed about how vulnerable she is when someone has access to her local login account (as Justin described). Avoiding a "false sense of security" really means helping to educate the user, and Chrome has failed to educate the user. Only the user knows what threats she needs to defend against (is it just a naughty little sister at home or a tech-savvy corporate spy breaking into her work computer?). Chrome should inform the user so she can make a choice that is in her interest. Nearly everyone in this thread is assuming that Chrome has to make the security/convenience tradeoff choice for the user. But Chrome can satisfy GOAL 2 by offering a few options. My proposal is that Chrome should present the user with a few clear choices in plain English with realistic explanations of the advantages and disadvantages of each, and the user can then pick her own security/convenience tradeoff. Let me give some suggested text to get the discussion going. I will suggest three specific behaviors to choose from, but these are just examples. Chrome engineers may decide on a different set of behaviors to offer (perhaps even still only one choice). The point is that the user MUST be presented with choices in plain English that give her enough information to avoid any "false sense of security." Even if Chrome offers no choices, Chrome MUST still inform the user about what she is getting when she chooses to save passwords. I suggest that after the user has just installed Chrome and she clicks to save her first password, she should be presented with the following choice (the choice will then persist until and unless she changes it Chrome settings): -------- BEGIN SUGGESTED TEXT ------------- Saved Passwords Security Please choose how you would like Chrome to restrict access to your saved passwords: CHOICE 1: No security: You or anyone sitting at your computer can view saved passwords at any time in the "Managed Saved Passwords" screen of Chrome settings. This option is the most convenient, but the least secure. If you use this option, consider locking your computer every time you leave it so that others cannot view your passwords. CHOICE 2: Master Password to view passwords only: Chrome will ask you to create a Master Password. You must type the Master Password whenever you want to view your saved passwords in the "Managed Saved Passwords" screen of Chrome settings. But you do not need to type your Master Password in order for Chrome to fill passwords into websites you visit. This option can prevent casual, non-technical users from seeing your passwords (e.g. practical jokes from siblings or coworkers), but it does not offer any meaningful security barrier to an even mildly technical user who has gotten access to your account on your computer. CHOICE 3: Master Password to view or use passwords: Chrome will ask you to create a Master Password. You must type the Master Password whenever you want to view your saved passwords in the "Managed Saved Passwords" screen of Chrome settings, AND you must type the Master Password every time Chrome is about to fill a password into a website that you visit. This option is the least convenient, but it offers a significantly higher barrier to a malicious, technical user who has gotten access to your account on your computer. Please be aware that none of these options offer complete protection in the event that a malicious user (or malware) has gotten access to your account on your computer. For example, such a user can always examine your history or install malicious plugins to track your browsing activity, even if you never save any passwords. These Saved Password Security options simply let you choose from amongst practically available tradeoffs of security and convenience. -------- END SUGGESTED TEXT ------------- In this suggestion, I have provided a #3 option which assumes that, under the hood, Chrome would NEVER store the Master Password in core or on disk, except during the short interval between when the user is prompted for it and when it is used to decrypt the website password. There is NOTHING magical about option #3 that offers 100% security. It is simply a higher barrier for bad guys to jump over (they have to hack into the binary's core at a particular moment to get the Master Password, or use other attacks not related to saved passwords). Option #3 may possibly be too inconvenient for anyone to choose: maybe a "sudo" timeout option is better, with different security/convenience tradeoffs. We can discuss all that.... But the main point is that Chrome must do a better job of informing the user about whatever behaviors it offers, and only then can Chrome truly avoid a "false sense of security."

tonyff 13y ago

By your argument users should not be prompted for their current password to change their password as that would provide them with a false sense of security. Or I guess now that they can just go and look up your password and then login and change it on the site they would not even need to do that. Security fail. You've set the bar way way way to low for easy compromise in seconds with no technical knowledge of computers needed.