google chrome password manager plaintext

We’ve also been repeatedly asked why we don’t just support a master password or something similar, even if we don’t believe it works. My point is that once the bad guy got access to your account the game was lost, because there are just too many vectors for him to get what he wants. Said bad guy can dump all your session cookies, grab your history, install malicious extension to intercept all your browsing activity, or install OS user account level monitoring software. Beyond that, however, we’ve found that boundaries within the OS user account just aren’t reliable, and are mostly just theater.Ĭonsider the case of someone malicious getting access to your account.

So, Chrome uses whatever encrypted storage the system provides to keep your passwords safe for a locked account. The only strong permission boundary for your password storage is the OS user account.

I’m the Chrome browser security tech lead, so it might help if I explain our reasoning here. In response to his rant, Google Chrome’s security chief Justin Schuh explained the company’s decision in this matter:

“Google isn’t clear about its password security,” he says, adding that when every day millions of “regular” OS X users save their passwords in Chrome, they are faced with a prompt that misleads them into thinking the passwords are safely stored in their keychain when, in actuality, Chrome bypasses that protection. While admitting that developers and more knowledgeable users are aware that once a malicious individual has physical access to a computer the jig is up and the computer is effectively at his or her mercy, regular computer users might believe that they are safe. “Why is ‘Saved passwords’ greyed out, and mandatory? Why have a check-box? This is the illusion of choice,” he says, and points out another thing that troubles him: the imported passwords can easily be revealed to anyone having physical access to the computer, via a click on the “Show” button in Chrome’s settings panel. When choosing to import his Safari bookmarks and settings into Google’s Chrome browser, software developer Elliot Kember discovered that although it seemed like he could opt out of importing his saved passwords, he had no choice but to do it:

Google chrome password manager plaintext