Issue metadata
Sign in to add a comment
|
Security: Password Manager allows user to view passwords
Reported by
engmahmo...@gmail.com,
Jul 24 2017
|
||||||||||||||||||||
Issue descriptionVULNERABILITY DETAILS Dear, Hope this email finds you well. I sent you this email to refer to one of the vulnerability that can threaten many of Google users’ account. Simply, everyone is permitted to sign up a new account in Google. After sign up is completed, it is asked if you are need to save your user name and password in Google chrome. Once, your user name and password is saved, you can sign in to many other accounts such as Facebook, Hotmail, twitter, instagram, banking account, etc. While you are signing all these account, Google chrome asked you to save their passwords and simply you enter yes. As a result Google chrome saves all my account password. This raises an intuitive question is whether Google chrome is designed to protect the privacy rights of these accounts. The answer to this question is simply no. this may return to the fact that when sign in to Google and click to Customize and control Google chrome – settings – advanced – manage passwords, I can be able to have an access on all the data information of other accounts. In case of personal computer has password, it means that the account is protected, otherwise, the account is threatened by outsiders and hackers. It is well known that even the computer password can be reset easily whatever it is personal through any third party software or business computer through domain admin. Actually, in my work I have under domain controller, any colleague can easily reset my computer password through calling IT centers. Finally, everyone should be protected his l her privacy right by Google. There are two ways to protect the user’s passwords in each account. First, the manage passwords area should be protected by the email password rather than computer password. Second, which is the most professional way is when the use enter the mange passwords area, a code can be sent to the user mobile to authenticate his/ her authority to access on this area and thus protect privacy right of the passwords. Hence, we can protect the danger that the computer password can be reset looking forward to receiving your feedback Best regards Mahmoud abdelraouf ali Mohamed VERSION Chrome Version: all Versions Operating System: [all Operating System ]
,
Jul 24 2017
Actually ,i am not talking about google chrome threats against computer users so your words about how to defend against a malicious user who has managed to log into your computer as you, or who can run software with the privileges of your operating system user account is not that case. i actually talks about passwords in google account in google chrome rather than in a personal computer. you don't respond to the above issue in a complete manner . for example , when my computer is lost without guaranteed password, it can threaten all passwords that exist in google account in google chrome please see attached file thanks a lot
,
Jul 24 2017
Google Chrome runs on a computing device, be it your personal computer or phone/tablet. If your computer is lost and you have not configured it securely (with an operating system password and encrypted file system) there's no way for any browser to keep the data on the system safe. (Keep in mind that Chrome encrypts stored passwords using the key generated from your operating system's login).
,
Jul 25 2017
Dear I appreciate your assistance and your quick feedback. But, actually want to remind you that the Google Privacy Policy that stated “We work hard to protect Google and our users from unauthorized access to or unauthorized alteration, disclosure or destruction of information we hold”. This means that Google chrome should protect the users from unauthorized access, including all different segments of users who differ in their socio demographic characteristics. First, for example, in emerging countries, there are different types of users that Google chrome should protect their privacy. It is found that a family that consists of 5 individuals, has only one personal computer that they share with each other due to the economic conditions. Hence, Google chrome doesn’t guarantee their privacy that stated by Google above. It doesn’t make sense that Google ensure its policy only on high income countries where, their users have their own personal computers. Second, in the previous email, I told you that I work in a banking industry and have a computer under domain and incase for a business leave or sudden absence, my colleague can reset my password of my computer due to the continual working conditions. In this case, this can threaten all my account s in Google chrome. According to my best knowledge, it can occurred in either small or big enterprise all over the world. Third, replied to your statement that if your computer is lost and you have not configured it securely, there's no way for any browser to keep the data on the system safe. If we reverse the situation that if some computers that have a secured password and configured securely are lost, these password can be reset easily through using third party software like PCUnlocker https://www.top-password.com/reset-windows-password.html It works on the modification SAM File in C:\Windows\System32\config, Very easy and simple . As a result, all users’ data will be under danger without any hacking Finally, I specified some cases, not all the cases that refer to this situation Thanks a lot
,
Jul 25 2017
On commodity operating systems (Windows/Mac/Linux/etc), the *only* way to protect one user's information from disclosure or modification by another user is to use a different operating system user account for each user. (Accounts are cost-free on all commodity operating systems; economics is not a factor.) With regard to the threat of administrative users, consult Microsoft's "10 Immutable Laws of Security", rule #6: "Law #6: A computer is only as secure as the administrator is trustworthy." https://technet.microsoft.com/en-us/library/hh278941.aspx. It's worth reading the entire document, as it clearly lays out the problem space. With regard to PCUnlocker and similar hacking tools: I believe Microsoft considers Bitlocker (or 3rd-party full disk encryption products) the appropriate mitigation against this sort of attack. Additionally, my recollection may be mistaken, but if I recall correctly the password-resetting attacks against the SAM destroy the private key used by the CryptoAPI, meaning that the Chrome-stored passwords would be rendered unreadable.
,
Jul 25 2017
This #5 is correct; resetting a user's password via a SAM modification or via an administrator on the computer would invalidate the keys used to secure the protected storage that Chrome uses to store passwords, as it's keyed from the user's login password - in fact Windows even warns for this specific case (see screenshot). Also agree that the best way to segregate users on a machine that is used by multiple people is to set up multiple user accounts.
,
Oct 15
Issue 895196 has been merged into this issue.
,
Nov 26
Issue 908150 has been merged into this issue. |
|||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||
Comment 1 by elawrence@chromium.org
, Jul 24 2017Status: WontFix (was: Unconfirmed)
Summary: Security: Password Manager allows user to view passwords (was: Security: Solution of Google chrome's vulnerability)