9

My friend recently told me that:

Google doesn't have our passwords saved on their database. Instead they put our password when typed on browser, through an algorithm and it'll produce a unique identifier. This identifier goes to database. And it is unable to reverse engineer/decode the password from the identifier.

Is this correct? Is Google's database unhackable and un-decodable? If not, how are our passwords saved on Google?

3
  • Why are you asking only about Google? The answer is essentially the same for every site you login to.
    – Barmar
    Feb 14 at 19:31
  • 2
    Are you asking about the passwords for Google accounts, or the passwords stored in Google's password manager?
    – vijrox
    Feb 14 at 22:01
  • It's an interesting question if Google's hashing algorithm is strong enough that not even all their own processing power could brute-force it, if they really wanted. Feb 14 at 22:05
14

Passwords should be stored hashed and salted

Because we must assume every database might get breached, plain text passwords should not be stored anywhere. Instead, the password should be hashed, which is a one-way algorithm, preferably using an algorithm that is slow to calculate and using different and long salt for every password. There are many articles explaining these methods in general, including CrackStation: Salted Password Hashing - Doing it Right.

Google account passwords

Unless Google has documented it somewhere (or the hashes were breached) we could not tell details about their implementation. We can only trust this giant is treating our passwords properly. But everybody makes mistakes, and even Google was actually storing plain text passwords in one of their solutions for 15 years (2005–2019). From Suzanne Frey: Notifying administrators about unhashed password storage:

Google’s policy is to store your passwords with cryptographic hashes that mask those passwords to ensure their security. However, we recently notified a subset of our enterprise G Suite customers that some passwords were stored in our encrypted internal systems unhashed. This is a G Suite issue that affects business users only–no free consumer Google accounts were affected–and we are working with enterprise administrators to ensure that their users reset their passwords.

Knowing this, as a user you should:

  1. Use a different password for every service. If one gets breached it does not affect all the others.
  2. Use strong, long passwords. If a hashed version of a password leaks, it will slow down the process of offline brute-forcing it.

To achieve both, using a password manager is recommended. A good password manager stores all passwords encrypted with a master password.

While it would be most secure to only store the passwords offline, it might be more convenient to synchronize the passwords between devices. This synchronization should keep the store encrypted: the passwords should not be stored plain in the cloud nor the service provider should even know any of the passwords for 3rd party services.

Google Chrome password manager (not a good choice)

As mentioned in the comments, Google Password Manager is a case where Google actually do have your plain text passwords on their servers without hashing them, as it is the only way to keep them usable while every Chrome installation logged in to your Google account has access to them. This does not meet the requirements for a good password manager established above.

It is possible to disable the synchronization from chrome://settings/syncSetup/advanced by switching the Passwords option off. However, it does not make the local store secure.

More to read:

6
  • 10
    If you use Google as your password manager they're certainly storing your actual passwords. But in a different database than their own account authentication database. Feb 14 at 13:20
  • 2
    @curiousdannii: Might add a few words on that, later, if it's not too much away from the original question. Not all password managers are equally secure in how they operate. Feb 14 at 16:02
  • 1
    I like how this answer allowed me to understand that the question was talking about password hashing.
    – Clockwork
    Feb 14 at 16:24
  • @curiousdannii: Hopefully it now covers this use case better. Feb 15 at 8:35
  • Not true, credentials are encrypted locally before sent to the server and only decryptable by your device (as the encryption/decryption key is your plain google password, only the hash of which is known to google). Mar 16 at 0:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.