5

Google Chrome browser helps in password management by prompting users to remember their passwords for the websites. These saved passwords can be accessed from the browsers "settings" menu, and to do so Chrome asks user for the Windows password. I understand this is for providing more security.

I read somewhere that the Windows password is hashed using NTLM hash. In order to view the saved passwords in Chrome, I have to provide my Windows password, which is fine. I believe that Chrome must be encrypting the saved passwords using my Windows password.

Now the question is how Chrome automatically fills the web page with the saved password without prompting me for the Windows password. How does Chrome decrypt the saved password for the website? This is really confusing.

Is my Windows password not hashed and Chrome has access to it for decrypting the saved passwords? Or does Chrome save passwords in plain without any encryption?

  • Saving passwords in a browser is bad. But Chrome uses the Windows secure store to encrypt passwords. Chrome probably then makes a request to the secure store and asks for a decrypted password. Windows decrypts the password with your Windows password, and gives Chrome the plaintext password to be inserted into the field. – RoraΖ Nov 10 '14 at 12:56
  • so passwords are not hashed on windows? IF windows decrypts the websites password with my windows password, that means the password is store in clear plain text? How does windows stored my windows password? – Curious Nov 10 '14 at 15:01
  • No, your password is used to generate an encryption key. Your password is not the encryption key itself. Your password is not stored in the clear. It's stored using the system's secure store. And that's a rabbit hole I'm not going down. – RoraΖ Nov 10 '14 at 15:08
  • then encryption key is stored in clear text? – Curious Nov 10 '14 at 15:34
  • 1
    No, it's encrypted using the system's secure store. And as I said, I'm not going down that rabbit hole. – RoraΖ Nov 10 '14 at 15:51
3

On Windows, your Chrome saved passwords are encrypted using DPAPI. This mechanism ultimately derives a key from your Windows account password to keep the data secure, and so once you've logged in, the data can be decrypted by applications that rely on this store.

So, Chrome doesn't have access to your Windows account password at all. It relies on the fact that you're logged in be able to access the decrypted password data for filling in the password fields for forms. If you try to view your saved passwords, because there are clearly very sensitive pieces of data it has you enter your password, and Windows verify that it's correct to better assure that not only is it you who are logged in, but also you who are currently sitting in front of your computer at this moment, because you're the only one who should know that password. So, at this point, it doesn't actually need the password to decrypt the data, it's just a security measure to help protect your passwords from casual prying eyes.

  • "So, at this point, it doesn't actually need the password to decrypt the data, it's just a security measure to help protect your passwords from casual prying eyes." this implies that chrome stores password in the clear text – Curious Nov 10 '14 at 16:20
  • 2
    @Curious No, it doesn't. It only means that once you're logged into Windows, they're available to Chrome in decrypted form. – Xander Nov 10 '14 at 16:24
  • ok, so basically the chrome doesn't ask me the password for decrypting, once the user logins, the passwords are available in decryption form. Chrome just asks the password for security measure. – Curious Nov 10 '14 at 16:29
  • @Curious Exactly. – Xander Nov 10 '14 at 16:32
  • 1
    They're stored using the Windows Data Protection API. – Xander Nov 11 '14 at 5:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.