0

I have an iMac 27" Late 2012. My browser is Google Chrome and I have a handful of passwords saved in it.

When I come across a website that requires authentication, Chrome automates it without asking me for my Google Account Password. My (administrative) user account on Mac OS X has a password, and it requires it on login, as well as when I need Superuser permissions (sudo, su, installing software etc...).

Power supply is now dead, so I'll have to send it to Apple for repair. I dunno how OS X has been implemented in Google Chrome passwords encryption, but I was wondering: can "Geniuses" (or so they call 'em) just plug in a Live Ubuntu USB (even OSX maybe) and get my Google password, subsequently getting access to all encrypted passwords stored in Google Chrome?

If that's so, then it's designed really badly!

  • If that's so, then it's designed really badly! Design it better. While there are better solutions, they have their own disadvantages. There's no magic bullet. (Especially not to protect people from themselves. If you are that worried about your passwords, you should've never given them out of your control) – deviantfan Jan 13 '17 at 23:28
  • Well, they could encrypt the passwords with Google password encrypted with login password – Manchineel Jan 13 '17 at 23:29
  • You know what I REALLY hate? When people downvote and then run away, without leaving a comment saying how the question could be imporoved. It makes questions look like they were "plz i deleted my minecraft world how do i restore it?????!!" – Manchineel Jan 14 '17 at 8:08
1

Short answer: if your account has no password or you gave them access, i'm afraid so. But even the Live USB won't work if that's not the case. (guessable passwords aside)

If that's so, then it's designed really badly!

Yes. Yes it would be. As you might've noticed, Google (Alphabet w/e) is somewhat skilled in making computers do what they want. That's why they try to make sure it is actually hard to steal the keys to your digital life.

Chrome browser used to use the OSses native cryptography interface for storing passwords as an encrypted blob.

As can be seen here, Chrome on OS X uses the Keychain for the master key. (The actual data has been moved to the browsers internal store in '16)

They use strong, publicly known encryption algorithm (3DES), that stood years of attack. There is no way we know of to attack these better than bruteforce. Which, at the current keylength, will take longer than the heat death of the universe if implemented properly.

Too bad it isn't implemented too well by google, despite arguably having one of the most active security departments in the world. If you can get into the account, everything's exposed. There's no way to set a master password.

They somehow thought it gave a false sense of security. Because someone could install a keylogger there's no added benefit.

But using a phone, a simple pattern will stop your classmates from reading your messages. Not too secure, but preventing >90% of the abuse with minimal impact to user experience. The android devs understood, and i understand the tradeoff.

Luckily there's plenty of third-party plugins that do have a master password setting.

  • 1
    So, if they can't guess my OSX user account, they can't decrypt the master password of Chrome saved passwords, right? – Manchineel Jan 14 '17 at 8:05
  • 1
    If you don't have your hard drive encrypted, they can with a live get your browser files... here your unique option is to use a strong master password. The only way to decrypt a master password is a dictionary or bruteforce attack. So keep that password very strong (lowercase, uppercase, numbers, symbols and pretty large) and they have nothing to do. – OscarAkaElvis Jan 14 '17 at 10:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.