2

Specifically, how did the new Microsoft Edge (based on Chromium?) import my passwords from Google Chrome (which are synced to my Google account and supposedly secure)?

I'm on Windows 10. Does Windows have a standard password exchange medium? What is stopping a malicious program getting my passwords from Google Chrome, possibly decrypting them by asking me to input my Windows password for another fake purpose, and secretly uploading them somewhere else?

Improve this question
1

1 Answer 1

Reset to default
5

What is stopping a malicious program getting my passwords from Google Chrome, possibly decrypting them by asking me to input my Windows password for another fake purpose, and secretly uploading them somewhere else?

Nothing.

On Windows, a program running under your account can access anything that belongs to you. The defense is "don't run malicious programs". This is particularly common in desktop OS's; mobile ones are much better in this regard.

Improve this answer
4
  • 1
    I know Windows doesn't have a secure permission system like the one Android got, but shouldn't there be some kind of Windows API that allows Google Chrome to store passwords securely?
    – user1857492
    May 2, 2020 at 2:12
  • @user1857492 yeah, generally when you want to view them, you need to enter system credentials
    – multithr3at3d
    May 2, 2020 at 2:59
  • @multithr3at3d I think that's "fake" protection. In particular, if you go to the website and let Chrome autofill the credential, you can use the developer console to pull it out of the password field.
    – Joseph Sible-Reinstate Monica
    May 2, 2020 at 3:00
  • Right now, there is an option of On-device encryption. With autofill on by default, expanding the elements of passwords.google.com in Edge Tools revealed little, assuming the encrypted data follows data-initial-setup-data, (could have sworn the first few url fields were there in an initial viewing though.) Could be Chrome (or any other browser) makes a copy in memory of the encrypted Google password list so to display it, once OAuth is provided, passwords should be masked in the HTML, and viewable for the user when either the tab is in focus or OAuth is not timed out.
    – Laurie Stearn
    Jun 4 at 14:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .