2

Specifically, how did the new Microsoft Edge (based on Chromium?) import my passwords from Google Chrome (which are synced to my Google account and supposedly secure)?

I'm on Windows 10. Does Windows have a standard password exchange medium? What is stopping a malicious program getting my passwords from Google Chrome, possibly decrypting them by asking me to input my Windows password for another fake purpose, and secretly uploading them somewhere else?

1 Answer 1

5

What is stopping a malicious program getting my passwords from Google Chrome, possibly decrypting them by asking me to input my Windows password for another fake purpose, and secretly uploading them somewhere else?

Nothing.

On Windows, a program running under your account can access anything that belongs to you. The defense is "don't run malicious programs". This is particularly common in desktop OS's; mobile ones are much better in this regard.

3
  • 1
    I know Windows doesn't have a secure permission system like the one Android got, but shouldn't there be some kind of Windows API that allows Google Chrome to store passwords securely? May 2, 2020 at 2:12
  • @user1857492 yeah, generally when you want to view them, you need to enter system credentials May 2, 2020 at 2:59
  • @multithr3at3d I think that's "fake" protection. In particular, if you go to the website and let Chrome autofill the credential, you can use the developer console to pull it out of the password field. May 2, 2020 at 3:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.