Suppose someone were to knick a "Login Data" file from a Windows computer's Google Chrome profile. They don't know the machine's user account password, but they may have some ideas as to what it could be, to try.

Is it at all possible for them to recover the plaintext passwords from the Login Data file? Is it encrypted with any other entropy aside from the user account password? Does the encryption method use any entropy from the hardware profile of the machine, or anything like that? What if they were certain that the user account password was very poor? How trivially might they go about cracking it?

Note the host computer runs Windows 7.

Relevant links:

http://www.howtogeek.com/70146/how-secure-are-your-saved-chrome-browser-passwords/ http://msdn.microsoft.com/en-us/library/windows/desktop/aa380261.aspx


In Windows, Chrome uses the Data Protection API (DPAPI) to Triple DES using your Windows user's password. This means that every other program running under your Windows user is able to decrypt the login data. In fact, that's how tools like ChromePass and ChromePasswordDecryptor work. They only decrypt the file and reveal the passwords only if you run them on the same system that encrypted the file (or, perhaps, provide the victim's Windows password).

If the attacker was only able to acquire the Login Data file (for example, you had the file on your memory stick and it was stolen/lost), then your login data are protected as strongly as your Windows password is.

  • Wait, then why does toting around the user data directory work? Or is that because of Chrome Sync? – Manishearth Oct 27 '13 at 6:25
  • 1
    @Manishearth That's actually the only part in your answer that is somewhat correct; the profile folder is almost completely portable, except one field in one SQLite database in one file... the password field. Try it, copy your profile from one machine to another (actually, just create a new user on the same machine) and see that you'll lose the stored passwords. – Adi Oct 27 '13 at 6:28
  • Hmm.. I'll admit that I've never really verified if the stored passwords get copied over as I store very few passwords. – Manishearth Oct 27 '13 at 6:29
  • Does anyone know how is the encryption performed when running Chrome under Ubuntu? Does Linux provide a similar data protection api? – HeatfanJohn Feb 22 '14 at 2:06
  • 1
    @HeatfanJohn Under Ubuntu, Chrome (versions after 16) uses GnomeKeyring to store passwords. GnomeKeyring handles the encryption using the user's password and regulates access under the user's active session. It works in a way similar to DPAPI, as in it provides an API to encrypt stuff (mainly keys, passwords, and secrets of that sort). – Adi Feb 22 '14 at 10:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.