I am planning to store the login credentials in Google Chrome content scripts. The content scripts will then use these credentials to login to a website when I open it in Chrome.

I wanted to understand the risks / issues in storing login credentials in a content script? Also, if this is not the way to go, is there some encryption mechanism to store the credentials and these can be access by my content script?

  • 7
    Anyone with access to your computer can gainst access to your credentials. Since the script is plain text there is nothng to protect it. There are other secure ways of keeping your login credentials like Chrome password manager that at least encrypts that data. – Ramhound May 10 '13 at 12:11

Anyone with read access to your computer can get access to the password. Even if the database (localStorage/whatever) is encrypted. All an attacker has to do is copy over the user data directory (~/.config/google-chrome on Linux; somewhere in AppData on Windows), start Chrome on their own pc with the --user-data-dir flag set to the copied directory, and use the app -- the stored credentials will be used to login to whatever site you're using (and they can be easily sniffed via the developer tools).

Instead, I suggest you see if the service has an authorization API. For example, you can have your extension request partial permissions to the Google account. Of course, if the data directory is stolen, then the attacker has access to these permissions. Many sites (like Twitter) support OAuth, that's another thing you can try. Most OAuth-enabled sites only give limited permissions via OAuth.

Otherwise, store the password on your server, and have the server do everything -- just use your extension for communicating with the server and displaying the result. This way, an attacker can only work within the bounds of what your extension can do.

In the end, whatever method you use to secure it, an attacker stealing the data directory will be able to do some damage. All you can do is help restrict the possibilities -- with the direct password, and attacker can do all sorts of stuff like change the password. With a restricted permissions API key, the attacker can only work within the bounds of those perms. If you do everything on the server, then the attacker cannot do much outside the capabilities of your extension, since the server only knows how to make certain types of requests to the page.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.