Hacker News Reader

Comment by sam_goody | Hacker News Reader

OT: The fact that Chrome offers to bring my passwords from browser to browser, means that they are being stored in plaintext by Google.

Aside from that I probably gave them permission to log in as me in one of the EULAs, why is it OK for them to store my passwords unencrypted. Who guarantees that there are no leaks at Google? Who guarantees that some malicious browser plugin (there have been MANY) has never figured out how to access my passwords - especially as if such a plugin can get the password to identify myself to Chrome, it can login anywhere to get the passwords.

Anyways, whenever I hear of leaked 1Passwords, I figure it is in such a vector - login on the browser. And the fact that they are doubling down on browser login, makes me less secure.

Paranoid, much?

View on HN

> The fact that Chrome offers to bring my passwords from browser to browser, means that they are being stored in plaintext by Google.

Why do you think that they cannot bring encrypted passwords from browser to browser?

All password managers need access to the plaintext version of the password at some point... They need to put that into the login field.

Chrome syncing across browsers does not mean they are being stored in plaintext. Your login is likely given you access to a key to decrypt them.

Chrome does have an ability to encrypt the password store with a different password of your choosing. In this case syncing still happens, but each browser install requires you to enter in the second password to unlock the store.

A malicious browser plugin does not need access to your password store to steal your password. Sooner or later you are going to log into a website and it will just steal it then.

The fact that Chrome offers to bring my passwords from browser to browser, means that they are being stored in plaintext by Google.

Not necessarily. For example, Google could be encrypting your passwords using your Google account password.

All password services that allow for transfer between devices or emergency backups store the passwords in a recoverable format (encrypted rather than hashed) on their servers. This concern is not unique to Chrome's password storage.

> Who guarantees that there are no leaks at Google?

The same guarantee that all cloud services offer for non-e2e-encrypted content. If you are concerned about this, you must not use any password manager that stores passwords outside of your machine.

> Who guarantees that some malicious browser plugin (there have been MANY) has never figured out how to access my passwords

Even if your passwords are stored locally rather than on a cloud service, a malicious browser plugin can inspect your behavior as you fill in a password. Nothing will protect your credentials from a malicious browser plugin.

> Paranoid, much?

Probably. But self hosted systems exist if you want to use one.

You can set your own passphrase in sync settings. This will enable end-to-end encryption and Google won't be able to read your synced data (not just passwords but also history and other synced data).

Reply on news.ycombinator.com