I read this post but I want to know more details. I know that Google uses a Windows' function called CryptProtectData to encrypt user passwords on Windows and Google only stores the encrypted forms of password on its database and does not know the encryption keys. So now my question is how the Sync actually works then!!! I mean how can I view my passwords on android device for example? To make my question more general, I want to know the work flow of such apps and password manager which claim to preserve privacy while protecting your data and more interestingly working on multiple platforms
There is a question of trust here. The common way for password synchronization is to have the element that receives the password change request to broadcast (using secure channels...) the new password to all other elements. Then each element is responsable for the way it stores the password in long time storage, either in plain text (or using a reversible encryption as obfuscation) if the user must be able to see it, or in an non invertible hash if all what is wanted is to be able to later validate the password. The former way is normally only used on client devices (here your android device), the latter should always be used server side (here on Google servers).
But to be able to synchronize passwords, the password has to be exchanged in plain text (or with a reversible encryption). You just trust the server for not storing it in that form...
One way to sync a password from
device a to
device b, without the service provider having knowledge of the password, would be as follows:
Client program on
device aretrieves the encrypted password from its local database, and decrypts the password using a function akin to CryptUnprotectData().
Plaintext password is transferred from client program on
device ato client program on
device b, through service provider, without service provider having knowledge of the plaintext password, using a methodology similar to that used by sync.com.
Client program on
device bencrypts the password using a function akin to CryptProtectData(), and stores the encrypted password in its local database.