If someone steals my unencrypted, password protected laptop, would they be able to get into my Google account?

Question

I have a laptop with Ubuntu 20.04 operating system. I am logged into my Chrome browser using my Google account. This means, every time I open my browser, I am already logged into all the Google services (Gmail + Chrome browser with all passwords + Photos + ...).

Let's say that someone would steal the laptop and would like to get into my Google account. What the attacker can do is boot his own Ubuntu from a pen drive and see the contents of my home directory. In this directory are, presumably, the login data (.config/ ...) that allow the Chrome browser to authenticate me. The attacker can then just copy this data to his own computer and impersonate me. Or can he?

There are two possible mechanisms that could prevent this:

1. Two factor authentication.

Each time I reinstall my system, I am asked for my password and security code. This is true even if my home directory has been left intact during the system re-install. It seems that Google somehow fingerprints the operating system to protect against this type of attack.

2. Encryption of the Google login data

I am not sure Ubuntu has a mechanism to do this, but if in fact some data was encrypted by default until you log in to the OS, this would save the day.

Are there some mechanisms that would protect the Google account in case of access to an unencrypted harddrive?

Answer 1

If someone steals my unencrypted, password protected laptop, would they be able to get into my Google account?

Yes.

Each time I reinstall my system, I am asked for my password and security code. This is true even if my home directory has been left intact during the system re-install. It seems that Google somehow fingerprints the operating system to protect against this type of attack.

They indeed fingerprint your OS and look for discrepancies, including source IP address/location, user agent, etc. I'm not 100% up to date about how they deal with these discrepancies.

As to resuming established sessions, a fresh build will have an empty cache and no cookies, so you'd naturally have to login. If you import your home directory you should be able to resume an established session. Specifically on gmail, on "trusted computers" the session cookie will last for at least 30 days before they require 2fa or a full re-login. You have some control over this, but ultimately it's the implementation of the application that dictates how the session management layer works.

I am not sure Ubuntu has a mechanism to do this, but if in fact some data was encrypted by default until you log in to the OS, this would save the day.

Are there some mechanisms that would protect the Google account in case of access to an unencrypted harddrive?

Full disk encryption is the definitive solution for private computers. On shared workstations, if you must use them, make absolutely sure you always logout from your session before leaving.

There are ways to encrypt home directories, but none that I would call simple or practical to implement. This is proposed to change by systemd-homed but it may take a few years until this trickles down into a default in desktop distros.

Browsers apply a level of encryption to their caches, but since you can usually use them without providing credentials, these are relatively weak protections.