Issue metadata
Sign in to add a comment
|
Security: Full-text display of google account password saved with smart lock
Reported by
jul.th...@gmail.com,
May 13 2017
|
||||||||||||||||||||
Issue descriptionVULNERABILITY DETAILS Passwords stored with Google Smart Lock are usually not readable without the root/user password. However, I found out that it is very simple to bypass this prompt for saved google account passwords: I have saved my password for my google account. In the google chrome settings I am able to see for which account and which website (here: accounts.google.com) I have stored information, but without seeing the actual password. Anyway, as already said, clicking on "show password" prompts a window for my root password. But as I know already for which service the password is saved, I can simply go to my google login page and let Chrome filling out the form automatically. Using the right-click->inspect function of chrome allows me to return the full-text value of the password. For details, see the reproduction case. Unfortunately, that issue is OS independent! VERSION Chrome Version: 53.0.2 + stable Operating System: Windows 10 (anyway, the bug is OS independent) REPRODUCTION CASE As mentioned above, go to the login of your google account and let the smart lock fill out the form. Then, simply right click and go to "inspect" and search for the corresponding html input element. Change its type from "password" to "text" and press enter and the stored password will appear in the input element. I have also attached a screenshot of the element. FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION No crash!
,
Aug 21 2017
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||
Comment 1 by elawrence@chromium.org
, May 14 2017Status: Duplicate (was: Unconfirmed)