9

Chrome's password manager allows for users to view their saved passwords on passwords.google.com. The saved passwords can be viewed on different devices as long as the user logs into their Google account. So, these passwords must be stored in a Google database. Is it known as to whether the passwords are encrypted in this database, so that Google wouldn't be able to know what your account passwords are?

  • Chrome's built-in password manager is different from Google's password manager. You are asking about how Google stores your password. – defalt Dec 29 '18 at 4:45
  • We can't know what Google does. Google could save these passwords in Fort Knox with hundreds of Guards, 4096 bit encryption, or they could be stored plain text in some weird database with standard credentials. We can't know, you can't either, we could ask Google but I highly doubt that they will reveal such critical information about their security architecture and they will most likely say that your passwords are 100% secure from bad hackers, but we can't really be sure how secure they store your passwords. Just don't use Google for such critical things as passwords. – user5339049 Jan 7 at 22:49
2

If you can see a password (in plain text), it cannot have been hashed. The definition of hashing is that this process is irreversible. An alternative, less secure way, to store passwords is to encrypt them. The problem is that you can decrypt passwords, but depending on your use case, this could be a feature and not a bug.

How Google Chrome saves your passwords depends on whether you want to store and use them across devices. When synchronization is turned on for passwords in Google Chrome, your passwords are saved to your Google Account. Otherwise, your passwords are only stored on Google Chrome on your computer.

Not hashing passwords is not a best security practice, but depending on your use case encryption could be acceptable in combination with other security measurements to prevent unauthorized access.

Learn more about storing passwords on Google Chrome on this page.

  • 3
    When synchronization is turned on, does Google have access to your plaintext passwords? – user129137 Dec 29 '18 at 0:04
  • 1
    There's an option to either encrypt passwords with your Google password, or you could set a separate key if you wanted (or at least there was last time I looked into this). – SilverlightFox Dec 29 '18 at 3:30
  • 1
    @user129137 Nobody (well, the programmers of course) really knows what is going on. As with every single password that is used for a service, it comes down to how much you trust the service. I do however not believe Google Chrome has access to plaintext passwords necessarily, as SilverlightFox pointed out there are ways to prevent them. But in the end it comes down to trust mostly. – Kevin Voorn Dec 29 '18 at 3:40
  • @Kevin Voorn I figure that we could know that the passwords are inaccessible to Google if they’re encrypted on the client side before they’re sent to Google, for example. But I do understand that in general it does come down to trust – user129137 Dec 29 '18 at 21:38
  • @silverlightfox is this for Chrome’s local password manager, or is it for the synced password manager associated with your google account? – user129137 Dec 29 '18 at 21:39
0

When syncing my passwords from Google to a new device, it asks me for a specific passphrase I chose for it (not my current Google password) and states that it was used to encrypt the password DB.

This makes me believe that the password DB is actually encrypted and decrypted only on the client side. Also, quote from the passwords.google.com website:

You have secured your Chrome data with a sync passphrase. You can access your data within Chrome on your syncing devices, but not from this website.

This can be checked by reverse engineering Chrome.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.