New issue
Advanced search Search tips

Issue 748120 link

Starred by 4 users

Issue metadata

Status: WontFix
Owner: ----
Closed: Jul 2017
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: ----
Type: Bug-Security



Sign in to add a comment

Security: Password Manager allows user to view passwords

Reported by engmahmo...@gmail.com, Jul 24 2017

Issue description



VULNERABILITY DETAILS

Dear, 

Hope this email finds you well. I sent you this email to refer to one of the vulnerability that can threaten many of Google users’ account. Simply, everyone is permitted to sign up a new account in Google.  After sign up is completed, it is asked if you are need to save your user name and password in Google chrome. Once, your user name and password is saved, you can sign in to many other accounts such as Facebook, Hotmail, twitter, instagram, banking account, etc.  

While you are signing all these account, Google chrome asked you to save their passwords and simply you enter yes.  As a result Google chrome saves all my account password. This raises an intuitive question is whether Google chrome is designed to protect the privacy rights of these accounts. The answer to this question is simply no. this may return to the fact that when sign in to Google and click to
 
Customize and control Google chrome – settings – advanced – manage passwords,
 
I can be able to have an access on all the data information of other accounts. 
In case of personal computer has password, it means that the account is protected, otherwise, the account is threatened by outsiders and hackers. It is well known that even the computer password can be reset easily whatever it is personal through any third party software or business computer through domain admin.

Actually, in my work I have under domain controller, any colleague can easily reset my computer password through calling IT centers. 

Finally, everyone should be protected his l her privacy right by Google. There are two ways to protect the user’s passwords in each account. First, the manage passwords area should be protected by the email password rather than computer password. Second, which is the most professional way is when the use enter the mange passwords area, a code can be sent to the user mobile to authenticate his/ her authority to access on this area and thus protect privacy right of the passwords. Hence, we can protect the danger that the computer password can be reset

looking forward to receiving your feedback
Best regards 

Mahmoud abdelraouf ali Mohamed

VERSION
Chrome Version: all Versions 
Operating System: [all Operating System ]

 
Components: UI>Browser>Passwords
Status: WontFix (was: Unconfirmed)
Summary: Security: Password Manager allows user to view passwords (was: Security: Solution of Google chrome's vulnerability)
The Password Manager is working as intended.

Physically-local attacks (as described here: https://www.chromium.org/Home/chromium-security/security-faq#TOC-Why-aren-t-physically-local-attacks-in-Chrome-s-threat-model-) are outside of Chrome's threat model.
Actually ,i am not talking about google chrome threats against computer users so your words about how to defend against a malicious user who has managed to log into your computer as you, or who can run software with the privileges of your operating system user account is not that case.  i actually talks about passwords in google account  in google chrome rather than in a personal computer.  you don't respond to the above issue in a complete manner . for example , when my computer is lost without guaranteed password, it can threaten all passwords that exist in google account in google chrome 

please see attached file 
thanks a lot 
pass.jpg
115 KB View Download
Google Chrome runs on a computing device, be it your personal computer or phone/tablet.

If your computer is lost and you have not configured it securely (with an operating system password and encrypted file system) there's no way for any browser to keep the data on the system safe. (Keep in mind that Chrome encrypts stored passwords using the key generated from your operating system's login).


 Dear
I appreciate your assistance and your quick feedback. But, actually want to remind you that the Google Privacy Policy that stated “We work hard to protect Google and our users from unauthorized access to or unauthorized alteration, disclosure or destruction of information we hold”. This means that Google chrome should protect the users from unauthorized access, including all different segments of users who differ in their socio demographic characteristics. 

First, for example, in emerging countries, there are different types of users that Google chrome should protect their privacy. It is found that a family that consists of 5 individuals, has only one personal computer that they share with each other due to the economic conditions. Hence, Google chrome doesn’t guarantee their privacy that stated by Google above. It doesn’t make sense that Google ensure its policy only on high income countries where, their users have their own personal computers.
Second, in the previous email, I told you that I work in a banking industry and have a computer under domain and incase for a business leave or sudden absence, my colleague can reset my password of my computer due to the continual working conditions. In this case, this can threaten all my account s in Google chrome.  According to my best knowledge, it can occurred in either small or big enterprise all over the world.
Third, replied to your statement that if your computer is lost and you have not configured it securely, there's no way for any browser to keep the data on the system safe.  If we reverse the situation that if some computers that have a secured password and configured securely are lost, these password can be reset easily   through using third party software like PCUnlocker 
https://www.top-password.com/reset-windows-password.html
It works on the modification SAM File in C:\Windows\System32\config, Very easy and simple

. As a result, all users’ data will be under danger without any hacking
 Finally, I specified some cases, not all the cases that refer to this situation 
Thanks a lot 

On commodity operating systems (Windows/Mac/Linux/etc), the *only* way to protect one user's information from disclosure or modification by another user is to use a different operating system user account for each user. (Accounts are cost-free on all commodity operating systems; economics is not a factor.) 

With regard to the threat of administrative users, consult Microsoft's "10 Immutable Laws of Security", rule #6: "Law #6: A computer is only as secure as the administrator is trustworthy." https://technet.microsoft.com/en-us/library/hh278941.aspx. It's worth reading the entire document, as it clearly lays out the problem space.

With regard to PCUnlocker and similar hacking tools: I believe Microsoft considers Bitlocker (or 3rd-party full disk encryption products) the appropriate mitigation against this sort of attack. Additionally, my recollection may be mistaken, but if I recall correctly the password-resetting attacks against the SAM destroy the private key used by the CryptoAPI, meaning that the Chrome-stored passwords would be rendered unreadable.

Comment 6 by wfh@chromium.org, Jul 25 2017

Labels: -Restrict-View-SecurityTeam
This #5 is correct; resetting a user's password via a SAM modification or via an administrator on the computer would invalidate the keys used to secure the protected storage that Chrome uses to store passwords, as it's keyed from the user's login password - in fact Windows even warns for this specific case (see screenshot).

Also agree that the best way to segregate users on a machine that is used by multiple people is to set up multiple user accounts.
set-password-alert-message.jpg
40.4 KB View Download
 Issue 895196  has been merged into this issue.
Issue 908150 has been merged into this issue.

Sign in to add a comment