19

I am very disconcerted with the Smart-Lock from Chrome. It seems any application installed on my Windows can access ALL my password in a snap.

I have installed True Key to test the application. I was hoping the application was offline, but it is not. Just for the record I tried to "import all logins from Chrome". I didn't have to go through Windows UAC, and True Key just got all my passwords.

I am very worried about this system and I don't understand how is it possible that people use that kind of system.

What do I misunderstand about security?

20

Chrome offers the ability to auto-fill passwords without you as a user having to enter any kind of authentication other than being logged onto the machine. This means it has to have all of the information required to access the stored passwords while running in that context.

This means that any other applications running in that context (under your user account) can also access that information.

The only thing Chrome can do is use Operating System level protection to stop other users reading your data. Under windows it uses the CryptProtectData function. This encrypts the data with your windows user credentials - including your password. If you forget your password then the data is unreadable - even if an administrator resets it (although with chrome passwords they are backed up online and would be recovered next time you logged into it with your google credentials).

What do I misunderstand about security?

Any software running on your system under your own user or an administrator should be assumed to have access to everything that you do. If it couldn't read the password out of the password store there are numerous other ways to get it. From the clumsy (start chrome, point it to chrome://settings/passwords and read them out of the UI) to pulling either the passwords or the Google API key out of chromes memory while it is running or injecting a fake root certificate and man in the middle-ing a connection to the website where the password is sent.

  • This means that any other applications running in that context (under your user account) can also access that information.. It shouldn't be the case. If I run an application, another application cannot access the context from that application unless there is a shared memory between these two applications, right? – nowox Nov 6 '17 at 12:12
  • Actually that is true only if the program is secured as much as possible against being accessed by others, which does not happen for browsers and most of their extensions/plug-ins. Otherwise, I can read and even alter it's memory content at any time. – Overmind Nov 6 '17 at 12:32
  • 2
    @Overmind - under most desktop OS's you can't secure against it - only obscure the information. Fundamentally applications are not well sandboxed by design in most desktop environments. – Hector Nov 6 '17 at 12:51
  • 17
    Generally, in a security context, if someone manages to run something under your user account permissions, you already lost. – BgrWorker Nov 6 '17 at 14:06
  • Agreed, BgrWorker. – Overmind Nov 7 '17 at 10:22
2

There are some things you need to consider:

  • A password manager is a convenience tool, not a security tool. If you want to have a secure password manager, it will have to keep everything encrypted, which actually cannot be proved in this case.
  • Using a password manager will always be more insecure compared to not using one unless you manually control its security aspects, which does not happen. You do not know where the data is stored, in what format and what is the process involved in accessing it.
  • Smart-Lock does not prove it's security at any point.
  • The cryptography and implementation details should at least be documented somewhere, but they’re not which makes me highly doubt Chrome's official statements like 'Your passwords are always encrypted'. They don't say 'where' that actually happens: when storing them, when they sync, when cache is used, when general communications happen, etc.
  • One conclusion of DEFCON 2016 states: 'Consumers are not able to evaluate security claims made by companies. We need more researchers investigating security claims made by companies on behalf of consumers.'
  • Everything is cached at a point. Your browser will use a lot of trans-cache any above average specific application will be able to read from that.
  • Comments are not for extended discussion; this conversation has been moved to chat. – Rory Alsop Nov 7 '17 at 8:36
  • 2
    "Using a password manager will always be more insecure compared to not using one" Well, that depends quite a lot on the alternative, doesn't it? For most average people, using a password manager is quite a bit more secure than not using one. – GrandOpener Nov 7 '17 at 9:53
  • I don't keep my passwords stored anywhere. – Overmind Nov 7 '17 at 10:18
  • 3
    @Overmind Yes you do, you keep them stored in your human memory. ;) This often (you may be the exception) encourages simpler passwords, more password reuse, and less frequent password changes; password managers encourage high-entropy and unique passwords, and many also actively encourage frequent password changes. From the point of view of "likelihood of attack", a password manager is definitely more secure than trying to remember every password, for many users. – IMSoP Nov 7 '17 at 10:48
  • They should keep them locked in an secure location then, not on their PC. On a PC or cloud they are not secure. I do not use simple ones, they are rather complex, but there are some math and logic algorithms behind them, so that's how I remember them. No need to reuse or change. – Overmind Nov 7 '17 at 11:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.