10

I recently installed Firefox and realised that it was able to successfully import all passwords that were stored in Chrome.
I had been using a sync passphrase in Chrome and I expect it to store the password in such a way that they cannot be read by any other software installed in the PC. At least this is what's told by the Google Chrome community. After all, Firefox being just another software installed in the same PC, if it can read my passwords, then any other software can do the same.

However, when I try to view a password using Google Chrome, it expects me to type the Windows password. Is it giving me some false security? Giving me the impression that passwords are encrypted?

How was Firefox able to read the so called "encrypted" passwords from my Chrome and store them in its database?
Is this a bug in Chrome?

I used Google Chrome latest today in a Windows 10 PC fully updated PC.

Improve this question
12
  • 1
    I expect it to store the password in such a way that they cannot be read by any other software installed in the PC Impossible. One non-admin userspace program running as user A can't ever hide data from another non-admin userspace program running as user A.
    – deviantfan
    Jul 28 '16 at 6:19
  • As for where the key does (not) come from, see superuser.com/questions/146742/…
    – deviantfan
    Jul 28 '16 at 6:23
  • Answer to a now deleted omment: I'm saying that any entity that a) can login on your computer as you or is a program started by you (enabling the use of the mentioned Windows functions), and b) has access to Chromes sqlite files on the hard disk, can access and decrypt the passwords. ... This doesn't mean the encryption is useless, but it won't help against people knowing your windows passwords or malware you got. Of course.
    – deviantfan
    Jul 28 '16 at 6:33
  • Shouldn't chrome have a better way of doing this? Such as encryption based not on the windows password or something?
    – Denis
    Jul 28 '16 at 7:00
  • Then it would need an own key, readable by other programs too...
    – deviantfan
    Jul 28 '16 at 7:15
4

Encryption in the user space usually works by storing the key in an encrypted keychain (keychain in OSX, Gnome Keyring, KDE wallet, whatever name Microsoft uses in Windows...). This keychain is either locked by a custom password or more traditionally by your user password, so whenever you log in, your system automatically unlock it.

This is pretty much what @deviantfan said in his third comment above. Another user can't view your passwords unless he knows your user credentials to be able to log in as you, or the master password to unlock the keychain if it's accepting a custom password for it (Gnome keyring and KDE wallet do).

So, why Firefox can read Chrome's passwords? Because the local password manager is unlocked upon you log in. I'm not sure you can do it the other way around (haven't tried). If you lock Firefox's password with a master password, can you import them to Chrome? It shouldn't unless you type the password during the importing process.

edit

You have more info in the following link, explained by Chrome's security teach lead. https://news.ycombinator.com/item?id=6165708

Improve this answer
7
  • Thank you for this answer. This means, I can simply write a software and it can be handed over to a person with the request to install. And when that person does install it, I can get all the beautifully combinations of usernames and passwords very easilly. I think this is a risk and may be somone can exploit it.
    – Denis
    Jul 28 '16 at 7:51
  • 1
    @Qwertylicious Right, that's why people should trust software they install... (or not install it)
    – deviantfan
    Jul 28 '16 at 8:41
  • Hmm.. can't chrome developers find a different solution to this? I like the way Firefox has implemented their encryption
    – Denis
    Jul 28 '16 at 8:57
  • 1
    I can't find it back anymore, but I remember seeing a Chrome dev state that they did not implement encryption using a master password because it would give the user a false sense of security.
    – Vivelin
    Jul 28 '16 at 10:21
  • 2
    @horsedrowner news.ycombinator.com/item?id=6165708
    – Ay0
    Jul 28 '16 at 10:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.