Vulnerability of Chrome's "Login Data" file after being orphaned from the host system

Question

Suppose someone were to knick a "Login Data" file from a Windows computer's Google Chrome profile. They don't know the machine's user account password, but they may have some ideas as to what it could be, to try.

Is it at all possible for them to recover the plaintext passwords from the Login Data file? Is it encrypted with any other entropy aside from the user account password? Does the encryption method use any entropy from the hardware profile of the machine, or anything like that? What if they were certain that the user account password was very poor? How trivially might they go about cracking it?

Note the host computer runs Windows 7.

Relevant links:

http://www.howtogeek.com/70146/how-secure-are-your-saved-chrome-browser-passwords/ http://msdn.microsoft.com/en-us/library/windows/desktop/aa380261.aspx

Answer 1

In Windows, Chrome uses the Data Protection API (DPAPI) to Triple DES using your Windows user's password. This means that every other program running under your Windows user is able to decrypt the login data. In fact, that's how tools like ChromePass and ChromePasswordDecryptor work. They only decrypt the file and reveal the passwords only if you run them on the same system that encrypted the file (or, perhaps, provide the victim's Windows password).

If the attacker was only able to acquire the Login Data file (for example, you had the file on your memory stick and it was stolen/lost), then your login data are protected as strongly as your Windows password is.