Chrome's Insane Password Security Strategy 482
jones_supa writes "One day web developer Elliott Kember decided to switch from Safari to Chrome and in the process, discovered possibly a serious weakness with local password management in Chrome. The settings import tool forced the passwords to be always imported, which lead Kember to further investigate how the data can be accessed. For those who actually bother to look at the 'Saved passwords' page, it turns out that anyone with physical access can peek all the passwords in clear text very easily with a couple of mouse clicks. This spurred a lengthy discussion featuring Justin Schuh, the head of Chrome security, who says Kember is wrong and that this behavior of Chrome has been evaluated for years and is not going to change."
Firefox is the same (Score:3, Informative)
I don't see what the fuss is about. (Score:2, Informative)
This functionality has been both in Chrome and Firefox for years now, so I don't see why people make a fuss about it only now..
Either you don't give other people access to your user account, or you use a 3rd party password-protected keystore like Keepass, Lastpass, 1Password, with a separate (or even 2-factor) authentication.
Re:This is also the case on Firefox (Score:5, Informative)
Firefox has the option to protect saved passwords with a master passwords and if you already unlocked the password store, in order to read password from the GUI, you need to unlock it again
Re:Firefox is the same (Score:4, Informative)
../../Set Masterpassword
face it : chrome sucks at security, but that's no big surprise.
Re:This is also the case on Firefox (Score:5, Informative)
So set a Master Password: https://support.mozilla.org/en-US/kb/use-master-password-protect-stored-logins [mozilla.org]
More here: http://kb.mozillazine.org/Master_password [mozillazine.org]
Almost no users actually use this: http://monica-at-mozilla.blogspot.com/2013/02/cant-live-with-them-cant-live-without.html [blogspot.com]
"....can be solved somewhat with master password, but only 1 out of 12K users had master password enabled"
Re:This is also the case on Firefox (Score:4, Informative)
From TFA:
The simple fact is that you need to lock your user account if you want to protect your information. If you don't do that, nothing else really matters because it's all just theater and won't actually stop anyone willing to invest minimal effort.
And there it is. The bottom line. Kember demands that Chrome engage in security theater and the Chrome authors said no. As they should.
Re:Firefox has done this for years (Score:5, Informative)
I don't think people realize that
Re:This is also the case on Firefox (Score:5, Informative)
I just checked and Chrome keeps my passwords in a file under "C:\Users\\AppData\Local\Google\Chrome\User Data\Default". This directory is permission locked to me only. Even other admins can't access it unless they add permissions manually.
As far as I can tell Chrome does use filesystem level security to protect individual user's passwords.
Re:This is also the case on Firefox (Score:5, Informative)
If only such a thing existed...
Oh, wait. It does.
http://lastpass.com/ [lastpass.com]
Re:This is also the case on Firefox (Score:3, Informative)
LastPass does exactly this.
Re:Master Password (Thuderbird+Firefox) (Score:3, Informative)
How many people use separate log-in's for the "Family" computer that stays on most of the time? Not very many I'd imagine,
More than you imagine, because teenagers insist upon it.
And in reality, its by far the easiest thing to set up, and the easiest thing to do.
Just select the Switch User button, and you are out of your account, ready for the next person to use it,
and its as secure as your computer's OS is (which might not be all that secure, but that's another issue).
Re:Master Password (Thuderbird+Firefox) (Score:3, Informative)
Chrome's security tech lead gives a pretty good answer here: [ycombinator.com]
Consider the case of someone malicious getting access to your account. Said bad guy can dump all your session cookies, grab your history, install malicious extension to intercept all your browsing activity, or install OS user account level monitoring software. My point is that once the bad guy got access to your account the game was lost, because there are just too many vectors for him to get what he wants.
People worried about the security of this are worried over the wrong things. Firefox's master password would do absolutely nothing to stop a dropped-in extension from monitoring webpages for when passwords are filled, grabbing the filled form-data, and storing it in the extensions own preferences; and that wouldnt even take a background process, admin privileges, or really anything more than the ability to drop a file in the firefox profile.
I would be willing to place a large bet that in any scenario that would allow me to recover Chrome or Safari passwords, I would also be able to recover firefox passwords that are locked with a master password, within a reasonable amount of time. As has been said many many times, anything that tries to protect against a malicious user with access to your user session is pure security theatre.
Re:Master Password (Thuderbird+Firefox) (Score:4, Informative)
Exactly. Mozilla's email client Thunderbird also uses a Master Password to unlock the view-ability of the stored passwords.
Chrome uses the same core OS key storage that Firefox/Thunderbird does, and encrypts with the same master password--if I save a password in Firefox, it's available in Chrome and vice-versa. Both use kwallet on KDE, gnome-keyring on Gnome platforms, keychain access on the Mac, etc.
You can lock access to view them however the OS does so (e.g. with gnome, either Applications->Settings->Passwords and Keys, and select "Lock passwords", or from the command line, and gnome automatically locks them when your screensaver locks; on KDE it's the "Wallet Manager", I forget which menu it's under; on the Mac it's Utilities->Keychain Access, and click the little lock at the top of the keychain to lock/unlock). All 3 of those systems default to using your login password and automatically unlocking the keychain when you log in, but you can set the password separately (and be prompted to unlock it when you go to use it) if you want.
The problem here is that Windows' password management doesn't offer a reasonable alternative, but that's not Chrome's fault.
For those who insist on saying that chrome's security method is good enough consider this: How many people use separate log-in's for the "Family" computer that stays on most of the time? Not very many I'd imagine, just too much trouble for most to deal with. This means that both other family members as well as house guests can casually access all those passwords in no time.
a) Lock your passwords when you turn over the computer
b) You don't actually need to log in and out all the time to use separate accounts on the communal machine. Mine is usually sitting there logged into a guest account that everyone can use, with a browser running as the guest. I'll also use if I'm just looking something up on IMDB or googling/wiki'ing a quick question or whatever. There's a button on the menubar to "Run browser as..." with options for me and each of my family members, which prompts for the user's password and then runs a browser as them--if I need to check email or pay a bill or something, that browser's got my info but it's not available from the guest account/browser.. That covers the vast majority of cases, you just need to remember to close your browser when you're done with it.
For more complicated stuff, I pop over to VT8, log in, do what I need to do, and pop back. If I'm in the middle of something and someone needs to use the machine briefly, I can lock my terminal and switch back to the guest terminal for a few minutes, then switch back and unlock my screen without really disrupting anything.