3 ms·

Whoa, It automatically imports everything from Chrome. Which includes cookies (and as extension login sessions), bookmarks, extensions etc. Is it just me or -

by gnufied 12y ago

Whoa, It automatically imports everything from Chrome. Which includes cookies (and as extension login sessions), bookmarks, extensions etc. Is it just me or - I find that somewhat scary.I daresay, I would expect Chrome to encrypt sensitive information it saves on disk. Yandex does not seem to have imported the plaintext passwords thankfully, but I don't think I trust a new service with this much of private information. In other words - Chrome, please stop random applications from copying my login sessions and cookies.

muyuu 12y ago
This is why security minded apps will log you off all the time. It's not to annoy you, it's because the session security model is just not safe in a computer that may be running untrusted applications. You're responsible of the applications you install not stealing your stuff or hijacking your sessions.
Maakuth 12y ago
That isn't necessarily very easy thing to implement. If the data is accessible by one application, how could it not be available by some other application running with the same credentials? Maybe some "vault" daemon running as a different user could do, but then it would only take reverse engineering the client part from Chrome (if it wouldn't be open source via Chromium already). And all this to protect the application data from other application user is willingly running? TL;DR: don't run applications you don't trust.
- gnufied 12y ago
  If you have configured Chrome with a Google account, on Linux - for me, it does ask me for password on restart. I am assuming the password is for decrypting the passwords it stores in browser's "manage passwords". Overall, I think either: a. Chrome can use that account password for decrypting the other senstive information too. b. or it can integrate with keychain of operation system. If I am not wrong, each time a new application accesses keychain of OS, OS prompts for user's password.
Pxtl 12y ago
Where would it store that encryption key? How would it store it in such a way that a Chromium fork wouldn't have good access to it to easily decrypt and copy the cookies anyways? Are you sure it's even an import? I wouldn't be surprised if this thing is just naively using the same cookie stores and bookmarks and whatnot live.
Rudism 12y ago
Chrome and Firefox both store cookies, bookmarks, etc. in unencrypted, unprotected sqlite databases in a user profile directory. Internet Explorer stores them in regular text files on the filesystem. Any application run by the same user has trivial access to all of that information. In many cases that information can't be sent out to an external server and then used to impersonate you, however. Google, for example, has a lot of safeguards to identify abnormal traffic like that and block it out. An application could, however, use the cookies/session info locally on your machine to do things without your knowledge.

by gnufied 12y ago

muyuu 12y ago

This is why security minded apps will log you off all the time. It's not to annoy you, it's because the session security model is just not safe in a computer that may be running untrusted applications. You're responsible of the applications you install not stealing your stuff or hijacking your sessions.

Maakuth 12y ago

That isn't necessarily very easy thing to implement. If the data is accessible by one application, how could it not be available by some other application running with the same credentials? Maybe some "vault" daemon running as a different user could do, but then it would only take reverse engineering the client part from Chrome (if it wouldn't be open source via Chromium already). And all this to protect the application data from other application user is willingly running? TL;DR: don't run applications you don't trust.

gnufied 12y ago
If you have configured Chrome with a Google account, on Linux - for me, it does ask me for password on restart. I am assuming the password is for decrypting the passwords it stores in browser's "manage passwords". Overall, I think either: a. Chrome can use that account password for decrypting the other senstive information too. b. or it can integrate with keychain of operation system. If I am not wrong, each time a new application accesses keychain of OS, OS prompts for user's password.

Pxtl 12y ago

Where would it store that encryption key? How would it store it in such a way that a Chromium fork wouldn't have good access to it to easily decrypt and copy the cookies anyways? Are you sure it's even an import? I wouldn't be surprised if this thing is just naively using the same cookie stores and bookmarks and whatnot live.

Rudism 12y ago

Chrome and Firefox both store cookies, bookmarks, etc. in unencrypted, unprotected sqlite databases in a user profile directory. Internet Explorer stores them in regular text files on the filesystem. Any application run by the same user has trivial access to all of that information. In many cases that information can't be sent out to an external server and then used to impersonate you, however. Google, for example, has a lot of safeguards to identify abnormal traffic like that and block it out. An application could, however, use the cookies/session info locally on your machine to do things without your knowledge.