Issue metadata
Sign in to add a comment
|
Users can still access all saved passwords, bookmarks and all the auto fill information in all of the machines even after the user changes Google account password in one of the machines.
Reported by
amelsele...@gmail.com,
Jan 5 2017
|
||||||||||||||||||||||
Issue descriptionUserAgent: Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36 Steps to reproduce the problem: 1. Open Google chrome with an existing login credentials in Machine-1. Make sure the chrome have a couple of bookmarks and saved passwords for the websites. 2. Change google account password in the settings menu. 3. Open Chrome page (already logged-in with the old credentials) from another machine say Machine-2. access the webpages that have saved passwords and bookmarks. What is the expected behavior? As soon as the user opens Chrome in Machine-2, the user should see a completely logged out chrome with no bookmarks and saved passwords as well as the user should get a prompt to enter credentials since the user had previously logged into the machine-2 with old credentials. What went wrong? The user still has access to the webpages with saved passwords, bookmarks as well as saved auto fill user data. This data can be last names, social security numbers etc. Google chrome failed to sign out the user from all the machines that he/she was using chrome. This is a significant security flaw because in the event a user forgets to sign out of a chrome account in one machine which is very likely happen can pose a serious breach of personal information as well as criminal activity. Did this work before? N/A Chrome version: 55.0.2883.87 Channel: stable OS Version: 10.0 Flash Version: Shockwave Flash 24.0 r0 This is a significant security flaw because in the event a user forgets to sign out of a chrome account in one machine which is very likely happen can pose a serious breach of personal information as well as criminal activity.
,
Jan 6 2017
Assigning to vasilii@ since vabr@ is marked OOO.
,
Jan 7 2017
,
Jan 10 2017
This works as intended. There are two types of sign-in - Sign in to Chrome (in chrome://settings/). That means that the bookmarks and passwords are synced across devices. The user isn't suppose to sign-in to Chrome on a random machine. - Sign in to the Google account in the web page. That gives access to the content area. Changing the password will sign the user out. Changing the Google password isn't supposed to wipeout all the devices. Syncing stops though. Sync folks, do you have something to add regarding remote wipeout?
,
Jan 25 2017
,
Apr 18 2017
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Nov 29
|
|||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||
Comment 1 by mmoroz@chromium.org
, Jan 5 2017Components: UI>Browser>Passwords