5

Services like Dashlane and Bitwarden are unable to decrypt your passwords without your Master Password.

So, how does Chrome do it when they also state that your passwords are encrypted using your Google username and password?

enter image description here

5
  • It would be simple and easy to simply decrypt your passwords with the old credentials, then re-encrypt with the new ones. Just like you would do if you wanted to change your master password in Dashlane or any other password manager.
    – schroeder
    Commented Aug 15, 2020 at 13:25
  • @schroeder I wanted to know about account recovery. Maybe I should edit.
    – sake
    Commented Aug 15, 2020 at 13:37
  • 2
    Just because you forgot your password does not mean Google did ...
    – schroeder
    Commented Aug 15, 2020 at 13:42
  • @schroeder: it's probably only the master key that is encrypted (or just otherwise protected) using the password, though, i.e. not the protected contents directly. Commented Aug 15, 2020 at 17:13
  • @EsaJokinen yep, from the available docs, it looks like they create a hash with the username and password and use that as a password on the master key. I can't confirm, though.
    – schroeder
    Commented Aug 15, 2020 at 19:27

2 Answers 2

2

I think the text is incorrect. According to the support article (on the upcoming "on-device encryption"), passwords are currently encrypted with a key that Google has access to:

How standard password encryption works

Today, your saved passwords are encrypted while they’re sent over any network and when they’re saved to Google. The encryption key, used to access your passwords, is safely stored in your Google Account. Google then uses this key to access (decrypt) your passwords when:

  • You access them on passwords.google.com, on your eligible devices, or in Chrome settings.
  • Your passwords get checked for security issues in the Password Checkup.

The article goes on to describe "on-device encryption". The description is incredibly unclear, but it sounds like "on-device encryption" might handle password resets by having you enter your new password on an existing device so it can re-encrypt the passwords under the new key (or equivalent). It's still not that secure (Google has access to your password every time you enter it), but it may make it harder for mass compromise via e.g. a court order from an unfriendly government.

So why does it say "Google username and password"?

It looks like the progression was

  • ~2014: "Encrypt synced passwords with your Google credentials"

    (slightly misleading, since your username/password are not actually used)

  • ~2017: "Encrypt synced passwords with your Google username and password"

    (the support article changes between May and July)

  • Current (2022): "Encrypt synced passwords with your Google Account"

    (Unclear when this happens; the text of the "credentials/username and password/Account" option was removed from the support article in Oct-Dec 2017).

My guess? Someone thought "credentials" was unclear and changed it to "username and password" (making it even more misleading!), and then someone else noticed and changed it to "Google Account".

2

Since Google doesn't share any official details on how this works, here is possible method for implementing a similar system,

  1. Google creates a master key using your Google username and password. It then encrypts your password using that key and stores it in their servers.
  2. When authenticating Chrome downloads the encrypted database and the master key. The master key will be encrypted locally without the use of your Google password. This allows the offline functionality.
  3. When the password is changed for your account, a new master key and db are generated. When syncing they will be downloaded to the device. Until they sync the local db & key will continue to work as before.

This method has a few advantages,

  1. It allows Google to update your master password without changing your account password & username when needed.
  2. Your Google Username or password doesn't have to be stored or transmitted.
  3. As the master password is associated with your account, you won't loose it as long as you have access to your Google account.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .