Chrome currently doesn't have a "Safe Master Password" feature, and according to this article (http://www.google.com/support/forum/p/Chrome/thread?tid=5f249c4fa04ecd17&hl=en), no plans to develop.
There are a couple pros and cons with the use of a Safe Master Password.
- All passwords are locked by your master password, and if you are careful with it you should be in good shape, barring some nightmarish exploit.
- All your passwords are available within the browser, makes it easy to use them and you don't need to write them down or put them somewhere potentially less secure.
- Managed within the browser, you don't have much of an excuse to use a easy password, or a repeatable password.
- That master password could get captured by a keylogger, and then you're up a creek. (which is one of Google's responses)
- If the browser gets exploited, all your passwords are potentially available to an attacker, over the same vector they just infected you on. Potentially, they could compromise every site you have stored. This would be a wonderful way to grab many credentials for online banking very very fast.
- The encryption on the harddrive MIGHT be defeated by resetting an admin password using one of many open source tools or mounting the drive on another OS, rendering it open to evildoers anyway. (NOTE: I have no idea how the mechanism in chrome works, but it's what I would if I were evil.)
I disagree with Google's assessment, most of these types of password based thefts are internet based, not physical theft based. The person who steals your laptop generally wants your laptop, not your credentials. It's just too difficult and risky to make a living by grabbing one laptop at a time. The addition of another master password, added in with the encryption chrome uses by default, would make a really strong combination in this type of theft. Additionally, all it takes is an export of the passwords according to this article (http://www.google.com/support/forum/p/Chrome/thread?tid=271fcd1030121083&hl=en) to reload a browser with all your dirty little secrets. If someone is going to secure my passwords, I want to hold the master password, not Google.
But, this brings up another issue: If your laptop IS stolen, how the hell are you going to know what passwords even need changing if they are locked in the browser?
This is why I use PasswordSafe (or it's cousin, KeePass). This way, I have a master password, it's separate from my browser, and I can back up the file somewhere besides the Google cloud (which is coincidentally secured with a Google password inside the Chrome browser). I also have a record of what passwords I need to change in the event that the laptop is stolen.
Google should reconsider it's position regarding a master password in Chrome. At the end of the day, it's an option you can choose to exercise, or ignore, at your respective peril. I recommend you tell them, I will be too.