How does Google's "on-device encryption" work?

Question

I use Google to store some of my passwords and I noticed a "On-Device encryption" option in Google Chrome settings, that I had disabled. From what I understood, by allowing this, the password would first be encrypted on my devices and only the encrypted string would then be stored on Google servers. So I have turned that on, confirmed it in my mobile phone (Android), set it to use lock screen as a key and everything came through sucessfully - it's (supposedly) now enabled.

But I am not really sure, how and whether does it work. It didn't give me any kind of "master key". When I am using password autofill function of Google Chrome browser on PC or mobile phone, it still does not ask me for anything.

Also, the Google Chrome on PC still warns me about "compromised passwords", so the Google still has to see the raw unencrypted passwords (unless there is some offline DB of compromised passwords in Google Chrome)

According to https://support.google.com/accounts/answer/11350823?visit_id=638154166731283006-3135705296&p=settings_password_ode&rd=1 , there should be some kind of "master key":

Just remember that if you lose the key to your data, you could lose your passwords and passkeys too.

But what key are they referring to? Where can I find the key?

On mobile phone, the key gets probably applied by unlocking the phone with pattern or fingerprint. But what about PC? How does it decrypt the passwords?

Answer 1

But what about PC? How does it decrypt the passwords?

It seems that the key that is used to decrypt your passwords on your computer is derived from your Google password.

See the section, 'How It Works', where it reads,

'Once on-device encryption is set up, you can use your Google password or the screen lock for compatible phones or tablets to unlock your password or passkey' (emphasis mine).

Also see further down, under 'How on-device encryption works', where it reads,

'When on-device encryption is set up, your passwords can only be unlocked on your device using your Google password or the screen lock for an eligible device. With on-device encryption, no one besides you will be able to access your passwords'.

I think the key that they are referring to in the section that you referenced in your question is really your Google password.

If that's the case, then it seems that Google is storing your encrypted passwords on their server. The encrypted passwords are downloaded to your device when you login to Google. Then, on your device, a key is derived from your Google password, and this key is used to decrypt your encrypted passwords. This way, Google never sees your plaintext passwords, and Google does not have the key to decrypt your passwords (because presumably they are only storing a salted hash of your Google password, and they are not storing your Google password in plaintext form).

With regard to the question of how the encrypted password file is synced between different devices, where a different password is used on each device: This problem is akin to the problem of broadcasting an encrypted message to multiple recipients. Just think of each device as a recipient. For example, on your Android device, suppose you add a new password to you password store. The encrypted password store is then broadcasted to all of your other devices, so that later, on your computer for example, you have the new password there as well. The problem of broadcasting an encrypted message to multiple recipients, where each recipient has a unique private / public keypair,has a well accepted solution. See Sharing files with others, encrypted on untrustworthy file storage (e.g. the cloud) for more info.

So, on your computer, it is likely that an asymmetric private/public keypair is derived from your Google password; and similarly on your Android device, a unique private/public keypair is derived from your screen unlock code.

Answer 2

I think the accepted answer is actually wrong. Let's check the fact in the google's own document:

First it said very clear it is a single unique key that is used to encrypt your data.

Encryption is just a way of making the info you save to Google more secure. Using a unique key, your info is made impossible to read by anyone else. Then, the only way to read the information is by unlocking it with the same unique key.

This unique key is stored on Google's server and google can use it to decrypt your data without your consent.

The encryption key, used to access your passwords, is safely stored in your Google Account. Google then uses this key to access (decrypt) your passwords

The following recovery option further verified my observation because if the google do not own your key in clear text, then it cannot recovery your encrypted data.

If you lose your Google password, you risk loss of access to your saved passwords. Keeping your account recovery phone number and email up-to-date can help regain access to your account if you lose your password.

But google do provide an option to let you control your own encryption key which in theory google won't record it. This is the hidden option sync passphrase.

The difference between on-device encryption & sync passphrase With sync passphrase, you choose a phrase to lock and unlock your data. You will lose access to your data if you forget your sync passphrase With a passphrase, you can use Google's cloud to store and sync your Chrome data without letting Google read it.

But I really have some doubt here because they did not disclose their actual algorithm and also no one can audit their code. They can simply just record your passphrase but still telling you they do not have it in your face.

So I think why risk to lock yourself out? just use the on device encryption and only store unimportant credential in there. For privacy you should use some dedicated password manager like bitwarden. For critical credentials you should never store it in any cloud, remember them, or less securely put them on a paper and hide it. Change your password more often.