1

I have a laptop with Ubuntu 20.04 operating system. I am logged into my Chrome browser using my Google account. This means, every time I open my browser, I am already logged into all the Google services (Gmail + Chrome browser with all passwords + Photos + ...).

Let's say that someone would steal the laptop and would like to get into my Google account. What the attacker can do is boot his own Ubuntu from a pen drive and see the contents of my home directory. In this directory are, presumably, the login data (.config/ ...) that allow the Chrome browser to authenticate me. The attacker can then just copy this data to his own computer and impersonate me. Or can he?

There are two possible mechanisms that could prevent this:

  1. Two factor authentication.

Each time I reinstall my system, I am asked for my password and security code. This is true even if my home directory has been left intact during the system re-install. It seems that Google somehow fingerprints the operating system to protect against this type of attack.

  1. Encryption of the Google login data

I am not sure Ubuntu has a mechanism to do this, but if in fact some data was encrypted by default until you log in to the OS, this would save the day.

Are there some mechanisms that would protect the Google account in case of access to an unencrypted harddrive?

  • 2
    Easiest option would be to boot into a live CD and change the password, that way they could just log directly into your user account and have everything work without changing the environment it runs in. – user Jun 1 at 13:01
  • Is there a reason for the constraint about no encrypted hard drives? Hard drive encryption would be the easiest way to deny the attacker access to your OS and your files. – gowenfawr Jun 1 at 13:04
  • 1
    @gowenfawr I am dual booting with Windows on a single HD. I tried to set up encryption for the Ubuntu partition, but failed. – Martin Drozdik Jun 1 at 13:07
  • 1
    Chrome uses Windows built-in crypto functions to encrypt cookies on Windows, but AFAICT there is no Linux equivalent. I guess it could do using Gnome Keyring or equiv, but doesn't. Encryption of the cookies themselves would protect your logged in sessions. Maybe you could use something like ecryptfs.org to encrypt the cookies directory - FDE is recommended though - a lot easier to maintain when up and running. – SilverlightFox Jun 1 at 14:05
2

If someone steals my unencrypted, password protected laptop, would they be able to get into my Google account?

Yes.

Each time I reinstall my system, I am asked for my password and security code. This is true even if my home directory has been left intact during the system re-install. It seems that Google somehow fingerprints the operating system to protect against this type of attack.

They indeed fingerprint your OS and look for discrepancies, including source IP address/location, user agent, etc. I'm not 100% up to date about how they deal with these discrepancies.

As to resuming established sessions, a fresh build will have an empty cache and no cookies, so you'd naturally have to login. If you import your home directory you should be able to resume an established session. Specifically on gmail, on "trusted computers" the session cookie will last for at least 30 days before they require 2fa or a full re-login. You have some control over this, but ultimately it's the implementation of the application that dictates how the session management layer works.

I am not sure Ubuntu has a mechanism to do this, but if in fact some data was encrypted by default until you log in to the OS, this would save the day.

Are there some mechanisms that would protect the Google account in case of access to an unencrypted harddrive?

Full disk encryption is the definitive solution for private computers. On shared workstations, if you must use them, make absolutely sure you always logout from your session before leaving.

There are ways to encrypt home directories, but none that I would call simple or practical to implement. This is proposed to change by systemd-homed but it may take a few years until this trickles down into a default in desktop distros.

Browsers apply a level of encryption to their caches, but since you can usually use them without providing credentials, these are relatively weak protections.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.