I understand that Chrome uses the OS's password storage mechanism to protect passwords on your computer. 1 I also understand that these passwords can be (in my case, are) protected with a passphrase of my choosing, for syncing them in the cloud.
Are my passwords safe when I'm logged out of my local Linux / Windows account?
There exist a means on both Linux2 and Windows3 for clearing / changing user account passwords. Can an attacker simply reset my local account password, log into it, open Chrome, and be able to use my passwords? Or does the OS password protection mechanism prevent this?
There are several sources that indicate that Keyring / Windows DPAPI derive the password store decryption key from your account password. 4
Is the Google Chrome "session" protected in this same way?
I'm just hesitant to "trust" that everything is safe without understanding what's going on under the hood.
It would feel good if Chrome would ask me for a master password, but they don't want to implement that feature. 5 I'm okay with that, as long as I know my data is protected by my OS account login.