6

Google Chrome browser helps in password management by prompting users to remember their passwords for the websites. These saved passwords can be accessed from the browsers "settings" menu, and to do so Chrome asks user for the Windows password. I understand this is for providing more security.

I read somewhere that the Windows password is hashed using NTLM hash. In order to view the saved passwords in Chrome, I have to provide my Windows password, which is fine. I believe that Chrome must be encrypting the saved passwords using my Windows password.

Now the question is how Chrome automatically fills the web page with the saved password without prompting me for the Windows password. How does Chrome decrypt the saved password for the website? This is really confusing.

Is my Windows password not hashed and Chrome has access to it for decrypting the saved passwords? Or does Chrome save passwords in plain without any encryption?

7
  • Saving passwords in a browser is bad. But Chrome uses the Windows secure store to encrypt passwords. Chrome probably then makes a request to the secure store and asks for a decrypted password. Windows decrypts the password with your Windows password, and gives Chrome the plaintext password to be inserted into the field.
    – RoraΖ
    Nov 10, 2014 at 12:56
  • so passwords are not hashed on windows? IF windows decrypts the websites password with my windows password, that means the password is store in clear plain text? How does windows stored my windows password?
    – Curious
    Nov 10, 2014 at 15:01
  • No, your password is used to generate an encryption key. Your password is not the encryption key itself. Your password is not stored in the clear. It's stored using the system's secure store. And that's a rabbit hole I'm not going down.
    – RoraΖ
    Nov 10, 2014 at 15:08
  • then encryption key is stored in clear text?
    – Curious
    Nov 10, 2014 at 15:34
  • 1
    No, it's encrypted using the system's secure store. And as I said, I'm not going down that rabbit hole.
    – RoraΖ
    Nov 10, 2014 at 15:51

1 Answer 1

4

On Windows, your Chrome saved passwords are encrypted using DPAPI. This mechanism ultimately derives a key from your Windows account password to keep the data secure, and so once you've logged in, the data can be decrypted by applications that rely on this store.

So, Chrome doesn't have access to your Windows account password at all. It relies on the fact that you're logged in be able to access the decrypted password data for filling in the password fields for forms. If you try to view your saved passwords, because there are clearly very sensitive pieces of data it has you enter your password, and Windows verify that it's correct to better assure that not only is it you who are logged in, but also you who are currently sitting in front of your computer at this moment, because you're the only one who should know that password. So, at this point, it doesn't actually need the password to decrypt the data, it's just a security measure to help protect your passwords from casual prying eyes.

6
  • 1
    "So, at this point, it doesn't actually need the password to decrypt the data, it's just a security measure to help protect your passwords from casual prying eyes." this implies that chrome stores password in the clear text
    – Curious
    Nov 10, 2014 at 16:20
  • 2
    @Curious No, it doesn't. It only means that once you're logged into Windows, they're available to Chrome in decrypted form.
    – Xander
    Nov 10, 2014 at 16:24
  • ok, so basically the chrome doesn't ask me the password for decrypting, once the user logins, the passwords are available in decryption form. Chrome just asks the password for security measure.
    – Curious
    Nov 10, 2014 at 16:29
  • @Curious Exactly.
    – Xander
    Nov 10, 2014 at 16:32
  • 1
    They're stored using the Windows Data Protection API.
    – Xander
    Nov 11, 2014 at 5:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .