14 ms·

Hey Justin, I'm the author. I appreciate your sentiments, but I feel like they may be out of touch with the way real people are using computers in the wild. My

Hey Justin, I'm the author. I appreciate your sentiments, but I feel like they may be out of touch with the way real people are using computers in the wild. My suggestion is to seriously re-evaluate this approach in light of the actual use-case of how people perceive these passwords. It appears as though many, many users don't expect these passwords to be visible. This is an important thing to take into consideration.

tmslnz 13y ago
No one in here has ever even thought of reading the plain text password(s?) of their gf, friend, nemesis or what, when they left their computer on and left the room. Yet that may be a good use case for a master password…
justinschuh 13y ago
I appreciate how this appears to a novice, but we've literally spent years evaluating it and have quite a bit of data to inform our position. And while you're certainly well intentioned, what you're proposing is that that we make users less safe than they are today by providing them a false sense of security and encouraging dangerous behavior. That's just not how we approach security on Chrome.
- elliottkember 13y ago
  Novice? I'm sorry, but whether I'm a novice has absolutely nothing to do with this. What I'm proposing is that you just don't show our passwords, all in one window, in plain text. I agree that this won't solve the problem, but would be a good first step. And I don't see how that would be dangerous. Alternatively, Chrome should make this more obvious so that users don't make assumptions about its security. How on earth can I convince you that many, many, many people are surprised and concerned about this? Can I direct them to you on Twitter?
  - justinschuh 13y ago
    It matters that you don't seem to understand the threat model here. You think your passwords are protected somehow in other applications, but they're simply not. The fact is that they're still trivially recoverable, and if the bad guy can read them at all than he already has access to fully compromise your entire OS user account. So, you're arguing that we take measures to make users think they're safe when they've already surrendered any pretense of security. Effectively, you're asking that we lull our users into a false sense of security. I've enumerated this multiple times now, so I'm not sure how else to explain it. The simple fact is that you need to lock your user account if you want to protect your information. If you don't do that, nothing else really matters because it's all just theater and won't actually stop anyone willing to invest minimal effort.
    - elliottkember 13y ago
      You're right, locking the operating system will secure it. But people aren't doing that. And people lend their computers to friends sometimes. It happens. I think the actual situation is that you don't understand how people are using computers, and how people expect them to behave - which is very important. Your software allows me to open up one application and see all passwords. It's likely the single most-used application, and the easiest attack vector on the machine. If I wanted your password, I'd try Chrome first. It's very widely-used, and therefore a huge vector. That is the problem here. Either change it, or better communicate the need to lock your system. Because to an average user on the street, this is a scary thing to be able to do so easily. Is there a public point of contact that I can speak to about this?
      - Throwadev 13y ago
        Elliottkmember is right here. Chrome's approach to this is absurd. What if you simply don't want friends, coworkers, significant others browsing your passwords? At least tell users that if they choose to save passwords in Chrome, that everyone who uses their computer, even pretty non-technical people, will be able to access those passwords. Tell them that storing their passwords in Chrome is unsafe. Justin, can you tell us the real reason Chrome does it this way? Because the reasons you list so far don't make sense.
  - papacity 13y ago
    You sound like an angry OS X / iOS developer trying to make a name for himself. This is old news, and I find it odd how you've decided to focus all of the attention on Chrome even though other browsers operate in a similar way. And frankly, if you’re dumb enough to let someone use your computer, after you've knowingly saved your passwords on it, you deserved to get hacked. Operating system profiles should be common knowledge by now.
  - bryanbroussard9 13y ago
    Give a knowledgeable person physical access to a computer, and all of the clear text views in the browser do not matter. Just crack the user's password and you have access to any stored passwords. The password paradigm is not perfect. There is no perfect solution. Personally I like being able to check passwords easily, while being intelligent enough to put barriers in the path of the 'general snooper.'
    - nomel 13y ago
      > Give a knowledgeable person physical access to a computer Or in this case, give anyone physical access to your computer, and they have all of your passwords. Security through obscurity is not security, but it still has practical uses. You could say that hiding the passwords behind the few clicks it takes is not real security, but it's still more useful than having the passwords displayed plaintext on a sidebar at all times.
- thekevan 13y ago
  That fact that you tell him he is wrong and never really explain the "why" makes me not believe you. What little explanation you do give is the abstinence argument. It sounds great but it is not what people are doing. Also, I think someone like a thief, jealous spouse, unscrupulous roommate or coworker or the like is much more likely to try and get someone's password to do evil with. The way Chrome is now, all a person needs is 4 or 5 minutes alone with the computer to get the user's passwords.
- deleted 13y ago
  [deleted]
- tewha 13y ago
  Elliot's right: Chrome's way of storing and presenting passwords is unacceptable and less than fully sane.
- randomstep 13y ago
  So why store passwords then? Doesn't that also lull users into a false sense of security? It seems to me you won't make token efforts to protect a user's password because that protection would be an illusion. So you would rather tell them the truth, so to speak, by letting them discover that their passwords are all easily visible by anyone who sits down at their machine. But if that's really the best you can do (I'm accepting this claim for the sake of argument), why store the passwords at all? Just by offering to store the passwords you are lying to the user, and lulling them into dangerous behavior. Do you have data that users expect the passwords to be shown, or that storing them and making them so easy to see has any positive effect on users' password hygiene or security behavior? As for me, I know never to ever allow Chrome to store any password. Has that made me more secure? And is that representative at all of the standard user? I highly doubt it, but don't have any evidence either way.
- dspillett 13y ago
  Before I start my reponse proper, I should point out that I know most other browsers, and most add-ons for them that perform the task of storing credentials, do much the same thing and are therefor no less insecure. This is why I recommend everyone avoid most credential storing products and turn off their browser's built-in facility (whichever browser they use). > I appreciate how this appears to a novice As you are in the process of defending storing passwords in plain form (or at least in a manner that allows them to be accessed in plain form so easily), without any warning that this is happening, I am of the opinion that you have no right to be so condescending as to publicly call someone else a novice. > but we've literally spent years evaluating it Some creationists have spent decades evaluating their position too. That does not make my any more inclined to agree with their assessment of the way the universe works, nor does it make me feel inclined to recommend that position to others. > and have quite a bit of data to inform our position. Please provide said data so that we can evaluate it, otherwise what you are saying here is simply "I'm right because I know that I'm right". > what you're proposing is that that we make users less safe than they are today by providing them a false sense of security and encouraging dangerous behavior. That's just not how we approach security on Chrome. That is EXACTLY how you are approaching security in Chrome it would seem. If the criticism of the way Chrome currently does these things is wrong for this reason then Chrome's behaviour is wrong for the same reason. Users will assume that the passwords are stored securely, or will be blissfully unaware that they even need to be, and will think they are safe when they are not. This argument may not make the alternate suggestion being made correct, you certainly believe that it is not, but your argument doesn't make Chrome's current position any less incorrect either. While here we all know that locking out workstations provides much better security (as mentioned in your earlier post) than a master password on the browser's credentials store would, the general public do not tend to have much concept of that in my experience (while it very much should be, it is not something most people give any thought to unless explicitly prompted). Letting them take their ignorance of the matter one step further is lulling them further into a false sense of security. You are not wrong in stating that users should lock their workstations when leaving them, and should have them set to auto-lock after a time in case they forget. Likewise we are not wrong in stating that any key store should be locked after use, and automatically locked after a period of inactivity (requireing the master password to be requested again). Essentially you are silently opting in (on the user's behalf) to exchanging security for convenience. This brings us full circle, back to the word "novice". With regard to my earlier acknowledgement that other vendors do the same thing, while I'm taking cheap shots like the "novice" thing above: "other people are doing it" is no more a valid excuse for irresponsable behaviour here than it was in the school playgound when we were five. We (by "we" I'm including developers, DBAs, technical managers, security experts, and other members of the technical "community") should be trying to teach users to take better care of their credentials and their information security more generally, making it inconvenient for them not to if neccessary rather than making it easy for them to continue to be blissfully ignorant of the situation.
- bashinator 13y ago
  If you don't want to lull your users into a false sense of security, then why doesn't the "save password?" dialog have a disclaimer reading, "All saved passwords can be viewed at chrome://settings/passwords". This simple notification would go a long way towards raising the level of awareness you seem to assume the average person already has.
  - euyyn 13y ago
    Then they might chose to use IE instead, which doesn't show that disclaimer yet is no different. The teaching that needs to be done is that letting a bad guy access your computer unlocked is game over.
    - Jayku1 13y ago
      Are you on XP with IE6 or something? IE uses the Windows credential store nowadays, which requires you to reenter your logon password before it will expose your password....
- zestyping 13y ago
  Seeing the data would be pretty convincing. Could you please share the data that leads you believe that: - Showing passwords in this fashion is consistent with most users' expectations about how their passwords can be accessed. - Requiring authentication before showing passwords has the effect of encouraging people to leave their computers unlocked in a potentially hostile environment.
  - Jayku1 13y ago
    I think the data in question is more likely to be feature usage statistics of the sort that show that when a browser does has a master password option, something less than 2% of users set it, and half of those unset it after they realize they're going to be prompted for it over and over and over all day.
- nphsmith 13y ago
  So,the Google response is - "a) You're stupid and don't understand. b) If a techie had access to your PC for half an hour he can get your passwords anyway, so letting an amateur get it in 5 seconds is OK, c) We're Google. We don't do evil. And you're stupid.
- dmaclay 13y ago
  This prevents Chrome from ever being my primary browser.
  - papacity 13y ago
    Too bad every other browser works the same way...
    - tewha 13y ago
      They don't.
      - papacity 13y ago
        Yeah they do. In Firefox go to preferences, security, and saved passwords. I don't know about Safari or Internet Explorer because they're shit and I don't use them.
        kumarharsh 13y ago
        Well, Firefox does also offer a "Master Password" if you haven't notice.
- simeyla 13y ago
  I realized this several years ago and was pretty dumbfounded, and quite surprised I've never read about this until now. Can you explain how the Chrome passphrase works in more detail and why it isn't used in this situation. If I sync my google account to another computer I need to enter a passphrase to sync passwords. Why isn't this asked for when clicking 'Show'? It seems like a perfect additional place. Even if its still 'trivial' to recover passwords you're still going to 'fool' a significant amount of people that it is secure and with Chrome's userbase that is a significant amount of people saved from themselves. And if you're still stubborn and arrogant enough to still make an argument against this then why not just put a damn 'Print my passwords' button on the main toolbar?
  - hokkos 13y ago
    Exactly what I was thinking, why don't they use it ?
- hobbes300 13y ago
  Your logic doesn't follow. According to your rules we shouldn't have doors on houses as all they do is provide a false sense of security. Don't forget, all security, regardless of how good it is, is just a delay mechanism. It's perfectly valid to delay the easy attacks as well as the hard ones.
- JohnHaugeland 13y ago
  (Edit: said "yahoo to reissue passwords" instead of "email addresses" initially, because I'm a derp.) ----- "I appreciate how this appears to a novice" Respectfully, I don't think this is a valid answer. This is the same sort of "I know better than you because I'm in the industry" thing that has led Yahoo! to believe that it's okay to re-issue email addresses: "we've done a study that we won't show you, we decline to address your criticisms, and we're right. We wanted to talk to you in public to create the illusion of interactivity and contact, but in reality we're ignoring your statements, refusing to explain ourselves, and declining to adjust." LinkedIn said literally exactly the same thing about their password strategy right before their plaintext password database got owned. It turns out that working at Google and saying nuh-uh isn't actually a valid form of explaining the security choices you're making in a way that almost nobody else is aware of. Having worked at IBM Security and the CIA doesn't change that. Whereas you may call the people pointing out the obvious problems in your approach amateurs, your ability to actually interpret what they say seems to be very, very limited. I would note that your own past employers agree. What you're doing is a violation of FIPS 140-3, which your former employers helped the NIST craft. No other browser does this. There's a good reason that everyone else does something different. . "[we] have quite a bit of data to inform our position" You have quite a bit of data to support that it is not a critical security defect to allow people to pull passwords out of a little known browser dialog? I find this unlikely, on grounds that I can't even imagine what sort of data would be used to support this. Am I correct in suspecting that you will absolutely refuse to explain this claim, yet still expect it to be taken seriously? . "what you're proposing is that that we make users less safe than they are today by providing them a false sense of security" No, eliminating a hidden attack vector does not create a false sense of security: nobody will know. In the meantime, an extant vulnerability will go away. This is the exact opposite of correct, and honestly fairly transparently so. . "And while you're certainly well intentioned, what you're proposing is that that we make users less safe" And while you're certainly well intentioned to suggest that a car should have seatbelts, what you're proposing is that we make users less safe by encouraging them to drive over fifteen miles an hour. The disconnect between your theory of how people use browsers and how people actually use browsers, as the head of security, making choices like these, is genuinely alarming. But you have data. Which, conveniently, nobody can see, or point out your misunderstandings within. Because that's how science works, or something, probably. . "encouraging dangerous behavior." Taking away a little known mechanism for people to extract saved passwords from the browser does not in any way encourage dangerous behavior. . "That's just not how we approach security on Chrome." It appears that how you do approach security on Chrome is with transparently false anecdotal claims backed up by no measurements, unprovided claims of difficult to guess about data, and no willingness to look at other peoples' points of view. In the whole of human security history, this has never gone well. Unfortunately, you have the provenance, and in unweildly large security organizations, that's often quite a bit more highly valued than actually hearing what other people say. It is absolutely fascinating that Google's browser's head of security thinks it's a good idea, backed by mystery data, to be able to pull saved passwords out. Of curiosity, do you honestly expect to be taken seriously when you fly in the face of every best practiced, based on data you won't provide, while just calling other people amateurs? You realize how this sounds, right? Like denial? Good lord. "We make your passwords recoverable from a dialog you don't know about because if we didn't you'd be encouraged into unsafe behavior." What unsafe behavior is that? Saving passwords? Seriously, you're intentionally leaving it weak so that nobody will use it for important things, but then not actually making them aware of that? Just take it out, then. Mind-boggling. Truly, these are the situations over which we abuse the phrase "stockholming."
neilk 13y ago
If I have access to your browser, I can get your credentials for Amazon by just going to Amazon.com. Either you already have a session open, and then I can do what I want (including changing your password), or the browser (or your password manager) is going to fill in the password automatically, and with a trivial knowledge of how the browser works I can copy the password. I use LastPass, and it is possible to set it so that a master password is required before any password is automatically entered, but in practice no ordinary user can suffer the loss of usability there. Passwords are not actually the thing we are trying to protect. We're trying to protect against a user being able to use your credentials. If they have access to your browser, they have that already. Maybe requiring you to re-enter your login session password, as a pseudo master password, would slow down a really naive attacker. But it will probably also annoy people who just need to get their passwords for some other reason. I would like to hear more from the Chrome team here on their reasoning but I would not be surprised if a 'master' password just leads to more users storing passwords on post-it notes.
- manicdee 13y ago
  My house has a front door which can be locked. I often leave it unlocked when I am out in the yard (and thus need access through the door on a minute-by-minute basis) or when I have guests over. I side my house I have safes, medicine cabinets and a gun rack. Those things are locked all the time, and I only unlock the cabinet when I need to use the items inside the secure container. So, too, I have a use account login. Sometimes I will hand my computer to a friend (or they sit at the computer, same thing) so they can do stuff. At no point does my friend's physical access to the computer imply that they need access to my bank account details. So those credentials are locked up in 1password to prevent casual theft. Keychain Access and 1password both require a master password to unlock the ability to see stored passwords. The argument about "having physical access negates security" is missing the point: there are different forms of physical access. I won't let visitors plug in random USB, FireWire or Thunderbolt devices for example. They have use of the machine, they have physical access. But if any of them made moves to dunk my computer in liquid nitrogen before removing the RAM, I would shoot them. If the computer is locked, my password safe is locked. If someone steals the computer (or an NSA agent inades my house to freeze and steal the RAM), the key material is encrypted and thus still not accessible to casual inspection. The attitude of "the NSA can break the encryption so it is not even worth hiding things from the visitor casually using your computer" is defeatist. Rethink your assumptions. What are you protecting against? Do I need to switch to a guest account to prevent casual guests from seeing my credentials? How does that aid convenience?
Spoike 13y ago
Technically passwords that should be retrieved at a later date are stored using two-way encryption. So the thing is, the passwords are always "visible", as they're retrievable. Removing the "Show" button is not really making things more secure as it is retrievable using other means. This is same with all browsers that save passwords. You could lock it away with a one-way encrypted password but the problem with that is it's just "theatrics", giving a false sense of security... the stored passwords are still two-way encrypted either way, or else they can't be retrieved for later use. That means it is just as breakable as if they weren't. Once the hacker finds the password database on your computer it should be considered compromised. If you don't trust your browser or your computer then you should use a service like LastPass or 1Password, i.e. if you consider them trustworthy to handle your passwords and if you're not on an insecure WIFI network. There is really no other way around it. I do agree though that all browsers should be more clear about it... unfortunately it's not particularly easy to explain computer security to a user who is not a computer science nerd.
filipmares 13y ago
I think Justin's arguments are fair. The reality is that you're using the browser under a certain user profile. If you want to really separate your data from other users using your computer i would suggest icognito sessions or creating different user profiles. If you share your user profile (active user) you expose all this data (bookmarks, extensions, passwords). Seems logical to me https://www.dropbox.com/s/kgrrtil2s7hi43j/Screenshot%202013-08-06%2015.56.46.png https://www.dropbox.com/s/kgrrtil2s7hi43j/Screenshot%202013-...
- lvs 13y ago
  Average people do not have the time, knowledge, or interest to do what you and Justin propose. Chrome is exposing what is arguably the very (very!) large majority of users who will never have the wherewithal to individually concoct an infosec strategy for their machines.
llvm4life 13y ago
Justin is right. This is why the browser I'm working on flashes your passwords in plaintext ever few seconds. Let's not pretend an attacker couldn't look over your shoulder anyhow.
mikelabatt 13y ago
Agreed. Normal non-technical people let friends have a look at their computer, and it is often a surprise for both that passwords can so easily be seen. Theory is one thing, but there is IMHO also a practical "don't make it too easy" factor that should be considered. As the saying goes, sometimes "opportunity makes a thief".
- nomel 13y ago
  According to his logic, something like a post it note stuck to my monitor, containing all my passwords, is just as easy to read as Google chromes password file, so there's no benefit in trying to hide the post it note.
therealbobdole 13y ago
I won't be using Chrome again until this behavior can be turned off.
- jewilmeer 13y ago
  You can just uncheck the 'offer to save passwords ...' mark within the settings of Chrome. I've removed all stored passwords and stick closely to 1Password now.
sequoia 13y ago
fwiw Pidgin takes this same approach for the same reasons. https://developer.pidgin.im/wiki/PlainTextPasswords https://developer.pidgin.im/wiki/PlainTextPasswords "locking" the passwords would require intermittent master-pass entry like `sudo`, this would come off as an inconvenience to many users. I think people here miss the fact that many users, even if they say they want more security, are unwilling to give up convenience and will switch platforms (i.e. browsers) if that's what it takes to get a smoother experience. In many ways (in this particular instance) security vs. convenience is more or less 0 sum- chrome team has decided users would prefer more convenience which means less security. Chrome team is giving users what they want: ease of use.
- SonicHedgehog 13y ago
  However, Pidgin “would encourage integration with keyrings” [0]. At least on OS X Chrome uses the integrated keychain and as Elusive mentioned [1] it apparently does encrypt passwords on Windows too. So, I think Pidgin’s situation is a bit different and if they would have keychain integration they may solve this differently than Chrome does right now. [0]: https://developer.pidgin.im/wiki/PlainTextPasswords#Isthatthefinalword https://developer.pidgin.im/wiki/PlainTextPasswords#Isthatth... [1]: https://news.ycombinator.com/item?id=6168039 https://news.ycombinator.com/item?id=6168039
  - interpol_p 13y ago
    On OS X Chrome pulls the passwords out of the keychain and then makes them completely accessibly in plaintext through the settings/passwords page. I have no idea why it does this.
    - LauRoman 13y ago
      How open of a platform is that keychain, and can Apple reserve the right to lock any aplication out?
      - interpol_p 13y ago
matthewww 13y ago
Sometimes you get glimpses into the inner sanctums of Google that make it seem like it's a culture of robots. Their first responses to outrage over the Google Maps cars they'd sent out to hoover people's wi-fi information were similarly obtuse about the mysterious ways of the non-machines: It's all information that was freely available to anyone who happened to have a fleet of packet-sniffing vehicles anyway, so what's the big deal? With Google Glass they seem clueless on both sides of the equation: Never mind the role that facial symmetry plays in beauty or the billion-dollars industries that have sprung up to relieve people of their despised eyeglasses, more data is always better, affirmative? And why would even silly water-machines mind being always photographed everywhere? In many senses they already are! Jeepers can extermination day not come quickly enough. And now this, here. Yes a given all-knowing cyborg entity could steal a "novice's" passwords with or without Chrome's help. But the easier you make it, the more it will happen. Meanwhile Google doesn't help its case with the clearly deceptive wording within the menus that make this possible. But mainly, our being from Google here seems genuinely baffled as to why this skeeves humans out so much. It just. Does. Not. Compute! It is their seeming contempt for their customers coupled with a bizarre tin-eared bafflement about aspects of human nature the rest of the world seemingly grasps intuitively that often make for... well, entertainment at any rate; this story is presently top-of-fold on Techmeme. But it also is a window into a massive blind spot that could hobble the company.
- eclipxe 13y ago
  You're reading way too much into this. But I kinda like it, so proceed.
PattiS 13y ago
Something for consideration, Chrome...it's not JUST security against badguys, it's also security against family members (aka, 13 year old son or daughter) who want to know what your password is so that they can do things online that you don't want them to do. You just can't make it EASY for people to SEE passwords. Sure, hacker badguys and even 13 year olds may get access to this information, but why make it easier for them to access? Or make it impossible for users NOT to import their passwords? I'm glad I have never clicked "save my password" on any browser.
jabbajac 13y ago
Actually, I think it may just be a better idea to prompt for a master password if someone click's show password. Since chrome can be tied to your google account I think using your google account password plus the second verification step before you can show any of the passwords would be a good solution. That way, your passwords are saved, and if you want to see them you need to verify that it's you.
williambhunt 13y ago
As an IT professional and tech trainer I do agree with Justin. There is a lot of general education that does need to go on with the public to make them understand this. If Chrome artificially lulled users into a false sense of security it would be just as bad. It's like places that put up fake video cameras and then when someone gets mugged they want to see the footage. The reality for end users is that they should not be storing important passwords to things like banking and most of the other ones can be recovered so easily that weather they are in plain text really makes little difference. Generally everyone has to get better about security and sites with a single layer of authentication like a password are really not all that secure to begin with.
MarkEllis 13y ago
I can do this in firefox too... Tools...options...saved passwords....show passwords... So I'm missing the point why it makes Chrome so bad?
- LauRoman 13y ago
  before the "show passwords" button, there is a "use a master password" option that is unticked by default. Generaly tho, i don't have any passwords there (all of them are in lastpass), except a few email account ones. Why do i have ANY passwords there? Well, they are being used by an extension that sort of needs them to push notifications about emails. I do have them protected by a master password, but the extension can still acess them. However, the extension has an option to ask for the password if i click one of the mailboxes in its menu. But then again i can still bypass that if i type the adress of one webmail provider, because i will get credentials for it. A good way around it would be if that extension developer would integrate with lastpass somehow, but does lastpass allow that? Now or in the future forevermore?
MarkEllis 13y ago
I can do this in firefox too... Tools...options...saved passwords....show passwords... So I'm missing the point why it makes Chrome so bad?
lightswitch05 13y ago
who the hell uses the saved password feature? Seriously, its a password, everyone knows you should never write down you passwords. why would saving it be any different? Chrome still has to provide the feature to compete with other browsers, but just because a feature exists doesn't mean you should use it. Think about it, he was able to import passwords from another browser. What does that say about how other browsers store their passwords? It is a stupid assumption that a saved password is secure.
grscjo3 13y ago
Why do you know better how people use it in the wild than Google? Don't they gather usage data from the browser? Maybe have the muscle to conduct large-scale interviews?
zachw 13y ago
The clear-text storage of Chrome passwords and the Google devs stubborn refusal to admit that this is a problem is VERY old news. It has been discussed ad nauseum for years. As is the frequent suggestion to store all passwords via third party utilities or services (keepass, lastpass, etc). The password protected password manager is the main reason why Firefox remains my primary browser. If my laptop is stolen, I'm confident that my passwords will be safe (although I still do not store banking related passwords.) More info at raidersec.blogspot.com/2013/06/how-browsers-store-your-passwords-and.html Encrypted passwords are only unlocked in FF during a single browser session after one has entered the master password. Do people not understand this??
yacoob 13y ago
It'd be worth nothing in your article that you can easily get that master password functionality under OSX - namely by locking the keychain. http://support.apple.com/kb/PH10698 http://support.apple.com/kb/PH10698 No idea how does it look like in other operating systems - especially under Linux which doesn't have THE keychain, it has keychains (ie. there's no common api to access a particular KDE/Gnome/etc implementation of it). With keychain locked, Chrome asks for its password every time it needs to fetch a password - be it showing a list of them or pulling a password for particular site. It's done in a proper manner, and if you hand the keys to your house to that guy... well, you better trust them :)
DripDrip 13y ago
Does Justin have a Post-It stuck to his monitor labeled "Secret - Please Don't peek" with all of his passwords written on the back? Pretty tempting to anyone that may be somewhat ethically challenged. Yeah, I don't leave my wallet on my desk either.
paulofthepark 13y ago
Way too easy. My little brother screwed me over twice with this. This has been an issue for me every since switching from firefox to chrome. If you're going to offer a saved password option at least give me a master password option too. or at least give me a warning that this is a dumb idea.We're not all security experts. By not enabling a thin layer of falls security you just turned my grandmother into a computer hacker. And being the head of security at chrome I'd think you would be able to secure chrome at a browser level even if it is vulnerable in the OS. Unacceptable, but then again I'm just a novice.
n00x 13y ago
There is a saying in hindi - "Taala sharifon ke liye hota hai.". Loosely translated as "locks are for decent people". We put the locks for decent people not thieves. For a thief its nothing but an inconvinience. And we still put the locks, don't we?
rojayc 13y ago
While Pidgin had this ridiculous approach too, what is preventing these schmucks from at least warning the user about storing it in clear ? I was shocked when I realized how it was being stored. Firefox at least requires a password before showing (I think). Just use LastPass already!
kumarharsh 13y ago
Dear Justin and other Chrome Devs I have been waiting for so long to bash you on this point. And now when it comes, I'm at an utter loss for words. What would it take to open your eyes to the severity of the matter? Are you really intending to let this slide away? Putting a master-password or some other level of security over the stored passwords is not such a big deal either that you would want to so actively evade them. Are you counting on insecure stored passwords as a "differentiating feature" from Firefox? I had stayed off Chrome for a long time due to the same reason: "No security for my stored passwords". But then I switched because Chrome became very fast and I used LastPass for storing passwords. I'm telling you this because I'll not shy away from recommending Firefox or even IE10 to other people when they are looking for a browser, because hey, Chrome lets other people see your passwords, just like that.
teeja 13y ago
Dear Google guy: better give it up, you're only digging your hole deeper.

tmslnz 13y ago

No one in here has ever even thought of reading the plain text password(s?) of their gf, friend, nemesis or what, when they left their computer on and left the room. Yet that may be a good use case for a master password…

justinschuh 13y ago

I appreciate how this appears to a novice, but we've literally spent years evaluating it and have quite a bit of data to inform our position. And while you're certainly well intentioned, what you're proposing is that that we make users less safe than they are today by providing them a false sense of security and encouraging dangerous behavior. That's just not how we approach security on Chrome.

elliottkember 13y ago
Novice? I'm sorry, but whether I'm a novice has absolutely nothing to do with this. What I'm proposing is that you just don't show our passwords, all in one window, in plain text. I agree that this won't solve the problem, but would be a good first step. And I don't see how that would be dangerous. Alternatively, Chrome should make this more obvious so that users don't make assumptions about its security. How on earth can I convince you that many, many, many people are surprised and concerned about this? Can I direct them to you on Twitter?
- justinschuh 13y ago
  It matters that you don't seem to understand the threat model here. You think your passwords are protected somehow in other applications, but they're simply not. The fact is that they're still trivially recoverable, and if the bad guy can read them at all than he already has access to fully compromise your entire OS user account. So, you're arguing that we take measures to make users think they're safe when they've already surrendered any pretense of security. Effectively, you're asking that we lull our users into a false sense of security. I've enumerated this multiple times now, so I'm not sure how else to explain it. The simple fact is that you need to lock your user account if you want to protect your information. If you don't do that, nothing else really matters because it's all just theater and won't actually stop anyone willing to invest minimal effort.
  - elliottkember 13y ago
    You're right, locking the operating system will secure it. But people aren't doing that. And people lend their computers to friends sometimes. It happens. I think the actual situation is that you don't understand how people are using computers, and how people expect them to behave - which is very important. Your software allows me to open up one application and see all passwords. It's likely the single most-used application, and the easiest attack vector on the machine. If I wanted your password, I'd try Chrome first. It's very widely-used, and therefore a huge vector. That is the problem here. Either change it, or better communicate the need to lock your system. Because to an average user on the street, this is a scary thing to be able to do so easily. Is there a public point of contact that I can speak to about this?
    - Throwadev 13y ago
      Elliottkmember is right here. Chrome's approach to this is absurd. What if you simply don't want friends, coworkers, significant others browsing your passwords? At least tell users that if they choose to save passwords in Chrome, that everyone who uses their computer, even pretty non-technical people, will be able to access those passwords. Tell them that storing their passwords in Chrome is unsafe. Justin, can you tell us the real reason Chrome does it this way? Because the reasons you list so far don't make sense.
- papacity 13y ago
  You sound like an angry OS X / iOS developer trying to make a name for himself. This is old news, and I find it odd how you've decided to focus all of the attention on Chrome even though other browsers operate in a similar way. And frankly, if you’re dumb enough to let someone use your computer, after you've knowingly saved your passwords on it, you deserved to get hacked. Operating system profiles should be common knowledge by now.
- bryanbroussard9 13y ago
  Give a knowledgeable person physical access to a computer, and all of the clear text views in the browser do not matter. Just crack the user's password and you have access to any stored passwords. The password paradigm is not perfect. There is no perfect solution. Personally I like being able to check passwords easily, while being intelligent enough to put barriers in the path of the 'general snooper.'
  - nomel 13y ago
    > Give a knowledgeable person physical access to a computer Or in this case, give anyone physical access to your computer, and they have all of your passwords. Security through obscurity is not security, but it still has practical uses. You could say that hiding the passwords behind the few clicks it takes is not real security, but it's still more useful than having the passwords displayed plaintext on a sidebar at all times.
thekevan 13y ago
That fact that you tell him he is wrong and never really explain the "why" makes me not believe you. What little explanation you do give is the abstinence argument. It sounds great but it is not what people are doing. Also, I think someone like a thief, jealous spouse, unscrupulous roommate or coworker or the like is much more likely to try and get someone's password to do evil with. The way Chrome is now, all a person needs is 4 or 5 minutes alone with the computer to get the user's passwords.
deleted 13y ago
[deleted]
tewha 13y ago
Elliot's right: Chrome's way of storing and presenting passwords is unacceptable and less than fully sane.
randomstep 13y ago
So why store passwords then? Doesn't that also lull users into a false sense of security? It seems to me you won't make token efforts to protect a user's password because that protection would be an illusion. So you would rather tell them the truth, so to speak, by letting them discover that their passwords are all easily visible by anyone who sits down at their machine. But if that's really the best you can do (I'm accepting this claim for the sake of argument), why store the passwords at all? Just by offering to store the passwords you are lying to the user, and lulling them into dangerous behavior. Do you have data that users expect the passwords to be shown, or that storing them and making them so easy to see has any positive effect on users' password hygiene or security behavior? As for me, I know never to ever allow Chrome to store any password. Has that made me more secure? And is that representative at all of the standard user? I highly doubt it, but don't have any evidence either way.
dspillett 13y ago
Before I start my reponse proper, I should point out that I know most other browsers, and most add-ons for them that perform the task of storing credentials, do much the same thing and are therefor no less insecure. This is why I recommend everyone avoid most credential storing products and turn off their browser's built-in facility (whichever browser they use). > I appreciate how this appears to a novice As you are in the process of defending storing passwords in plain form (or at least in a manner that allows them to be accessed in plain form so easily), without any warning that this is happening, I am of the opinion that you have no right to be so condescending as to publicly call someone else a novice. > but we've literally spent years evaluating it Some creationists have spent decades evaluating their position too. That does not make my any more inclined to agree with their assessment of the way the universe works, nor does it make me feel inclined to recommend that position to others. > and have quite a bit of data to inform our position. Please provide said data so that we can evaluate it, otherwise what you are saying here is simply "I'm right because I know that I'm right". > what you're proposing is that that we make users less safe than they are today by providing them a false sense of security and encouraging dangerous behavior. That's just not how we approach security on Chrome. That is EXACTLY how you are approaching security in Chrome it would seem. If the criticism of the way Chrome currently does these things is wrong for this reason then Chrome's behaviour is wrong for the same reason. Users will assume that the passwords are stored securely, or will be blissfully unaware that they even need to be, and will think they are safe when they are not. This argument may not make the alternate suggestion being made correct, you certainly believe that it is not, but your argument doesn't make Chrome's current position any less incorrect either. While here we all know that locking out workstations provides much better security (as mentioned in your earlier post) than a master password on the browser's credentials store would, the general public do not tend to have much concept of that in my experience (while it very much should be, it is not something most people give any thought to unless explicitly prompted). Letting them take their ignorance of the matter one step further is lulling them further into a false sense of security. You are not wrong in stating that users should lock their workstations when leaving them, and should have them set to auto-lock after a time in case they forget. Likewise we are not wrong in stating that any key store should be locked after use, and automatically locked after a period of inactivity (requireing the master password to be requested again). Essentially you are silently opting in (on the user's behalf) to exchanging security for convenience. This brings us full circle, back to the word "novice". With regard to my earlier acknowledgement that other vendors do the same thing, while I'm taking cheap shots like the "novice" thing above: "other people are doing it" is no more a valid excuse for irresponsable behaviour here than it was in the school playgound when we were five. We (by "we" I'm including developers, DBAs, technical managers, security experts, and other members of the technical "community") should be trying to teach users to take better care of their credentials and their information security more generally, making it inconvenient for them not to if neccessary rather than making it easy for them to continue to be blissfully ignorant of the situation.
bashinator 13y ago
If you don't want to lull your users into a false sense of security, then why doesn't the "save password?" dialog have a disclaimer reading, "All saved passwords can be viewed at chrome://settings/passwords". This simple notification would go a long way towards raising the level of awareness you seem to assume the average person already has.
- euyyn 13y ago
  Then they might chose to use IE instead, which doesn't show that disclaimer yet is no different. The teaching that needs to be done is that letting a bad guy access your computer unlocked is game over.
  - Jayku1 13y ago
    Are you on XP with IE6 or something? IE uses the Windows credential store nowadays, which requires you to reenter your logon password before it will expose your password....
zestyping 13y ago
Seeing the data would be pretty convincing. Could you please share the data that leads you believe that: - Showing passwords in this fashion is consistent with most users' expectations about how their passwords can be accessed. - Requiring authentication before showing passwords has the effect of encouraging people to leave their computers unlocked in a potentially hostile environment.
- Jayku1 13y ago
  I think the data in question is more likely to be feature usage statistics of the sort that show that when a browser does has a master password option, something less than 2% of users set it, and half of those unset it after they realize they're going to be prompted for it over and over and over all day.
nphsmith 13y ago
So,the Google response is - "a) You're stupid and don't understand. b) If a techie had access to your PC for half an hour he can get your passwords anyway, so letting an amateur get it in 5 seconds is OK, c) We're Google. We don't do evil. And you're stupid.
dmaclay 13y ago
This prevents Chrome from ever being my primary browser.
- papacity 13y ago
  Too bad every other browser works the same way...
  - tewha 13y ago
    They don't.
    - papacity 13y ago
      Yeah they do. In Firefox go to preferences, security, and saved passwords. I don't know about Safari or Internet Explorer because they're shit and I don't use them.
      - kumarharsh 13y ago
        Well, Firefox does also offer a "Master Password" if you haven't notice.
simeyla 13y ago
I realized this several years ago and was pretty dumbfounded, and quite surprised I've never read about this until now. Can you explain how the Chrome passphrase works in more detail and why it isn't used in this situation. If I sync my google account to another computer I need to enter a passphrase to sync passwords. Why isn't this asked for when clicking 'Show'? It seems like a perfect additional place. Even if its still 'trivial' to recover passwords you're still going to 'fool' a significant amount of people that it is secure and with Chrome's userbase that is a significant amount of people saved from themselves. And if you're still stubborn and arrogant enough to still make an argument against this then why not just put a damn 'Print my passwords' button on the main toolbar?
- hokkos 13y ago
  Exactly what I was thinking, why don't they use it ?
hobbes300 13y ago
Your logic doesn't follow. According to your rules we shouldn't have doors on houses as all they do is provide a false sense of security. Don't forget, all security, regardless of how good it is, is just a delay mechanism. It's perfectly valid to delay the easy attacks as well as the hard ones.
JohnHaugeland 13y ago
(Edit: said "yahoo to reissue passwords" instead of "email addresses" initially, because I'm a derp.) ----- "I appreciate how this appears to a novice" Respectfully, I don't think this is a valid answer. This is the same sort of "I know better than you because I'm in the industry" thing that has led Yahoo! to believe that it's okay to re-issue email addresses: "we've done a study that we won't show you, we decline to address your criticisms, and we're right. We wanted to talk to you in public to create the illusion of interactivity and contact, but in reality we're ignoring your statements, refusing to explain ourselves, and declining to adjust." LinkedIn said literally exactly the same thing about their password strategy right before their plaintext password database got owned. It turns out that working at Google and saying nuh-uh isn't actually a valid form of explaining the security choices you're making in a way that almost nobody else is aware of. Having worked at IBM Security and the CIA doesn't change that. Whereas you may call the people pointing out the obvious problems in your approach amateurs, your ability to actually interpret what they say seems to be very, very limited. I would note that your own past employers agree. What you're doing is a violation of FIPS 140-3, which your former employers helped the NIST craft. No other browser does this. There's a good reason that everyone else does something different. . "[we] have quite a bit of data to inform our position" You have quite a bit of data to support that it is not a critical security defect to allow people to pull passwords out of a little known browser dialog? I find this unlikely, on grounds that I can't even imagine what sort of data would be used to support this. Am I correct in suspecting that you will absolutely refuse to explain this claim, yet still expect it to be taken seriously? . "what you're proposing is that that we make users less safe than they are today by providing them a false sense of security" No, eliminating a hidden attack vector does not create a false sense of security: nobody will know. In the meantime, an extant vulnerability will go away. This is the exact opposite of correct, and honestly fairly transparently so. . "And while you're certainly well intentioned, what you're proposing is that that we make users less safe" And while you're certainly well intentioned to suggest that a car should have seatbelts, what you're proposing is that we make users less safe by encouraging them to drive over fifteen miles an hour. The disconnect between your theory of how people use browsers and how people actually use browsers, as the head of security, making choices like these, is genuinely alarming. But you have data. Which, conveniently, nobody can see, or point out your misunderstandings within. Because that's how science works, or something, probably. . "encouraging dangerous behavior." Taking away a little known mechanism for people to extract saved passwords from the browser does not in any way encourage dangerous behavior. . "That's just not how we approach security on Chrome." It appears that how you do approach security on Chrome is with transparently false anecdotal claims backed up by no measurements, unprovided claims of difficult to guess about data, and no willingness to look at other peoples' points of view. In the whole of human security history, this has never gone well. Unfortunately, you have the provenance, and in unweildly large security organizations, that's often quite a bit more highly valued than actually hearing what other people say. It is absolutely fascinating that Google's browser's head of security thinks it's a good idea, backed by mystery data, to be able to pull saved passwords out. Of curiosity, do you honestly expect to be taken seriously when you fly in the face of every best practiced, based on data you won't provide, while just calling other people amateurs? You realize how this sounds, right? Like denial? Good lord. "We make your passwords recoverable from a dialog you don't know about because if we didn't you'd be encouraged into unsafe behavior." What unsafe behavior is that? Saving passwords? Seriously, you're intentionally leaving it weak so that nobody will use it for important things, but then not actually making them aware of that? Just take it out, then. Mind-boggling. Truly, these are the situations over which we abuse the phrase "stockholming."

neilk 13y ago

If I have access to your browser, I can get your credentials for Amazon by just going to Amazon.com. Either you already have a session open, and then I can do what I want (including changing your password), or the browser (or your password manager) is going to fill in the password automatically, and with a trivial knowledge of how the browser works I can copy the password. I use LastPass, and it is possible to set it so that a master password is required before any password is automatically entered, but in practice no ordinary user can suffer the loss of usability there. Passwords are not actually the thing we are trying to protect. We're trying to protect against a user being able to use your credentials. If they have access to your browser, they have that already. Maybe requiring you to re-enter your login session password, as a pseudo master password, would slow down a really naive attacker. But it will probably also annoy people who just need to get their passwords for some other reason. I would like to hear more from the Chrome team here on their reasoning but I would not be surprised if a 'master' password just leads to more users storing passwords on post-it notes.

manicdee 13y ago
My house has a front door which can be locked. I often leave it unlocked when I am out in the yard (and thus need access through the door on a minute-by-minute basis) or when I have guests over. I side my house I have safes, medicine cabinets and a gun rack. Those things are locked all the time, and I only unlock the cabinet when I need to use the items inside the secure container. So, too, I have a use account login. Sometimes I will hand my computer to a friend (or they sit at the computer, same thing) so they can do stuff. At no point does my friend's physical access to the computer imply that they need access to my bank account details. So those credentials are locked up in 1password to prevent casual theft. Keychain Access and 1password both require a master password to unlock the ability to see stored passwords. The argument about "having physical access negates security" is missing the point: there are different forms of physical access. I won't let visitors plug in random USB, FireWire or Thunderbolt devices for example. They have use of the machine, they have physical access. But if any of them made moves to dunk my computer in liquid nitrogen before removing the RAM, I would shoot them. If the computer is locked, my password safe is locked. If someone steals the computer (or an NSA agent inades my house to freeze and steal the RAM), the key material is encrypted and thus still not accessible to casual inspection. The attitude of "the NSA can break the encryption so it is not even worth hiding things from the visitor casually using your computer" is defeatist. Rethink your assumptions. What are you protecting against? Do I need to switch to a guest account to prevent casual guests from seeing my credentials? How does that aid convenience?

Spoike 13y ago

Technically passwords that should be retrieved at a later date are stored using two-way encryption. So the thing is, the passwords are always "visible", as they're retrievable. Removing the "Show" button is not really making things more secure as it is retrievable using other means. This is same with all browsers that save passwords. You could lock it away with a one-way encrypted password but the problem with that is it's just "theatrics", giving a false sense of security... the stored passwords are still two-way encrypted either way, or else they can't be retrieved for later use. That means it is just as breakable as if they weren't. Once the hacker finds the password database on your computer it should be considered compromised. If you don't trust your browser or your computer then you should use a service like LastPass or 1Password, i.e. if you consider them trustworthy to handle your passwords and if you're not on an insecure WIFI network. There is really no other way around it. I do agree though that all browsers should be more clear about it... unfortunately it's not particularly easy to explain computer security to a user who is not a computer science nerd.

filipmares 13y ago

I think Justin's arguments are fair. The reality is that you're using the browser under a certain user profile. If you want to really separate your data from other users using your computer i would suggest icognito sessions or creating different user profiles. If you share your user profile (active user) you expose all this data (bookmarks, extensions, passwords). Seems logical to me https://www.dropbox.com/s/kgrrtil2s7hi43j/Screenshot%202013-08-06%2015.56.46.png https://www.dropbox.com/s/kgrrtil2s7hi43j/Screenshot%202013-...

lvs 13y ago
Average people do not have the time, knowledge, or interest to do what you and Justin propose. Chrome is exposing what is arguably the very (very!) large majority of users who will never have the wherewithal to individually concoct an infosec strategy for their machines.

llvm4life 13y ago

Justin is right. This is why the browser I'm working on flashes your passwords in plaintext ever few seconds. Let's not pretend an attacker couldn't look over your shoulder anyhow.

mikelabatt 13y ago

Agreed. Normal non-technical people let friends have a look at their computer, and it is often a surprise for both that passwords can so easily be seen. Theory is one thing, but there is IMHO also a practical "don't make it too easy" factor that should be considered. As the saying goes, sometimes "opportunity makes a thief".

nomel 13y ago
According to his logic, something like a post it note stuck to my monitor, containing all my passwords, is just as easy to read as Google chromes password file, so there's no benefit in trying to hide the post it note.

therealbobdole 13y ago

I won't be using Chrome again until this behavior can be turned off.

jewilmeer 13y ago
You can just uncheck the 'offer to save passwords ...' mark within the settings of Chrome. I've removed all stored passwords and stick closely to 1Password now.

sequoia 13y ago

fwiw Pidgin takes this same approach for the same reasons. https://developer.pidgin.im/wiki/PlainTextPasswords https://developer.pidgin.im/wiki/PlainTextPasswords "locking" the passwords would require intermittent master-pass entry like `sudo`, this would come off as an inconvenience to many users. I think people here miss the fact that many users, even if they say they want more security, are unwilling to give up convenience and will switch platforms (i.e. browsers) if that's what it takes to get a smoother experience. In many ways (in this particular instance) security vs. convenience is more or less 0 sum- chrome team has decided users would prefer more convenience which means less security. Chrome team is giving users what they want: ease of use.

SonicHedgehog 13y ago
However, Pidgin “would encourage integration with keyrings” [0]. At least on OS X Chrome uses the integrated keychain and as Elusive mentioned [1] it apparently does encrypt passwords on Windows too. So, I think Pidgin’s situation is a bit different and if they would have keychain integration they may solve this differently than Chrome does right now. [0]: https://developer.pidgin.im/wiki/PlainTextPasswords#Isthatthefinalword https://developer.pidgin.im/wiki/PlainTextPasswords#Isthatth... [1]: https://news.ycombinator.com/item?id=6168039 https://news.ycombinator.com/item?id=6168039
- interpol_p 13y ago
  On OS X Chrome pulls the passwords out of the keychain and then makes them completely accessibly in plaintext through the settings/passwords page. I have no idea why it does this.
  - LauRoman 13y ago
    How open of a platform is that keychain, and can Apple reserve the right to lock any aplication out?
    - interpol_p 13y ago

matthewww 13y ago

Sometimes you get glimpses into the inner sanctums of Google that make it seem like it's a culture of robots. Their first responses to outrage over the Google Maps cars they'd sent out to hoover people's wi-fi information were similarly obtuse about the mysterious ways of the non-machines: It's all information that was freely available to anyone who happened to have a fleet of packet-sniffing vehicles anyway, so what's the big deal? With Google Glass they seem clueless on both sides of the equation: Never mind the role that facial symmetry plays in beauty or the billion-dollars industries that have sprung up to relieve people of their despised eyeglasses, more data is always better, affirmative? And why would even silly water-machines mind being always photographed everywhere? In many senses they already are! Jeepers can extermination day not come quickly enough. And now this, here. Yes a given all-knowing cyborg entity could steal a "novice's" passwords with or without Chrome's help. But the easier you make it, the more it will happen. Meanwhile Google doesn't help its case with the clearly deceptive wording within the menus that make this possible. But mainly, our being from Google here seems genuinely baffled as to why this skeeves humans out so much. It just. Does. Not. Compute! It is their seeming contempt for their customers coupled with a bizarre tin-eared bafflement about aspects of human nature the rest of the world seemingly grasps intuitively that often make for... well, entertainment at any rate; this story is presently top-of-fold on Techmeme. But it also is a window into a massive blind spot that could hobble the company.

eclipxe 13y ago
You're reading way too much into this. But I kinda like it, so proceed.

PattiS 13y ago

Something for consideration, Chrome...it's not JUST security against badguys, it's also security against family members (aka, 13 year old son or daughter) who want to know what your password is so that they can do things online that you don't want them to do. You just can't make it EASY for people to SEE passwords. Sure, hacker badguys and even 13 year olds may get access to this information, but why make it easier for them to access? Or make it impossible for users NOT to import their passwords? I'm glad I have never clicked "save my password" on any browser.

jabbajac 13y ago

Actually, I think it may just be a better idea to prompt for a master password if someone click's show password. Since chrome can be tied to your google account I think using your google account password plus the second verification step before you can show any of the passwords would be a good solution. That way, your passwords are saved, and if you want to see them you need to verify that it's you.

williambhunt 13y ago

As an IT professional and tech trainer I do agree with Justin. There is a lot of general education that does need to go on with the public to make them understand this. If Chrome artificially lulled users into a false sense of security it would be just as bad. It's like places that put up fake video cameras and then when someone gets mugged they want to see the footage. The reality for end users is that they should not be storing important passwords to things like banking and most of the other ones can be recovered so easily that weather they are in plain text really makes little difference. Generally everyone has to get better about security and sites with a single layer of authentication like a password are really not all that secure to begin with.

MarkEllis 13y ago

I can do this in firefox too... Tools...options...saved passwords....show passwords... So I'm missing the point why it makes Chrome so bad?

LauRoman 13y ago
before the "show passwords" button, there is a "use a master password" option that is unticked by default. Generaly tho, i don't have any passwords there (all of them are in lastpass), except a few email account ones. Why do i have ANY passwords there? Well, they are being used by an extension that sort of needs them to push notifications about emails. I do have them protected by a master password, but the extension can still acess them. However, the extension has an option to ask for the password if i click one of the mailboxes in its menu. But then again i can still bypass that if i type the adress of one webmail provider, because i will get credentials for it. A good way around it would be if that extension developer would integrate with lastpass somehow, but does lastpass allow that? Now or in the future forevermore?

MarkEllis 13y ago

I can do this in firefox too... Tools...options...saved passwords....show passwords... So I'm missing the point why it makes Chrome so bad?

lightswitch05 13y ago

who the hell uses the saved password feature? Seriously, its a password, everyone knows you should never write down you passwords. why would saving it be any different? Chrome still has to provide the feature to compete with other browsers, but just because a feature exists doesn't mean you should use it. Think about it, he was able to import passwords from another browser. What does that say about how other browsers store their passwords? It is a stupid assumption that a saved password is secure.

grscjo3 13y ago

Why do you know better how people use it in the wild than Google? Don't they gather usage data from the browser? Maybe have the muscle to conduct large-scale interviews?

zachw 13y ago

The clear-text storage of Chrome passwords and the Google devs stubborn refusal to admit that this is a problem is VERY old news. It has been discussed ad nauseum for years. As is the frequent suggestion to store all passwords via third party utilities or services (keepass, lastpass, etc). The password protected password manager is the main reason why Firefox remains my primary browser. If my laptop is stolen, I'm confident that my passwords will be safe (although I still do not store banking related passwords.) More info at raidersec.blogspot.com/2013/06/how-browsers-store-your-passwords-and.html Encrypted passwords are only unlocked in FF during a single browser session after one has entered the master password. Do people not understand this??

yacoob 13y ago

It'd be worth nothing in your article that you can easily get that master password functionality under OSX - namely by locking the keychain. http://support.apple.com/kb/PH10698 http://support.apple.com/kb/PH10698 No idea how does it look like in other operating systems - especially under Linux which doesn't have THE keychain, it has keychains (ie. there's no common api to access a particular KDE/Gnome/etc implementation of it). With keychain locked, Chrome asks for its password every time it needs to fetch a password - be it showing a list of them or pulling a password for particular site. It's done in a proper manner, and if you hand the keys to your house to that guy... well, you better trust them :)

DripDrip 13y ago

Does Justin have a Post-It stuck to his monitor labeled "Secret - Please Don't peek" with all of his passwords written on the back? Pretty tempting to anyone that may be somewhat ethically challenged. Yeah, I don't leave my wallet on my desk either.

paulofthepark 13y ago

Way too easy. My little brother screwed me over twice with this. This has been an issue for me every since switching from firefox to chrome. If you're going to offer a saved password option at least give me a master password option too. or at least give me a warning that this is a dumb idea.We're not all security experts. By not enabling a thin layer of falls security you just turned my grandmother into a computer hacker. And being the head of security at chrome I'd think you would be able to secure chrome at a browser level even if it is vulnerable in the OS. Unacceptable, but then again I'm just a novice.

n00x 13y ago

There is a saying in hindi - "Taala sharifon ke liye hota hai.". Loosely translated as "locks are for decent people". We put the locks for decent people not thieves. For a thief its nothing but an inconvinience. And we still put the locks, don't we?

rojayc 13y ago

While Pidgin had this ridiculous approach too, what is preventing these schmucks from at least warning the user about storing it in clear ? I was shocked when I realized how it was being stored. Firefox at least requires a password before showing (I think). Just use LastPass already!

kumarharsh 13y ago

Dear Justin and other Chrome Devs I have been waiting for so long to bash you on this point. And now when it comes, I'm at an utter loss for words. What would it take to open your eyes to the severity of the matter? Are you really intending to let this slide away? Putting a master-password or some other level of security over the stored passwords is not such a big deal either that you would want to so actively evade them. Are you counting on insecure stored passwords as a "differentiating feature" from Firefox? I had stayed off Chrome for a long time due to the same reason: "No security for my stored passwords". But then I switched because Chrome became very fast and I used LastPass for storing passwords. I'm telling you this because I'll not shy away from recommending Firefox or even IE10 to other people when they are looking for a browser, because hey, Chrome lets other people see your passwords, just like that.

teeja 13y ago

Dear Google guy: better give it up, you're only digging your hole deeper.