Saved passwords cannot be removed without physical access to machine.
Reported by
avadh...@gmail.com,
Aug 2 2017
|
|||
Issue descriptionUserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36 Steps to reproduce the problem: "Friend's Machine": 1.Login with google account in Chrome browser. 2.Sync passwords. (This is so you can browse all your websites with saved passwords) 3.Go to gmail.com and it logs in automatically. 4.Log out of your gmail. 5.Close chrome. The general user would feel that after logging out of their gmail account and closing chrome they have logged out completely and do not need to do anything else. More advanced users will understand that they need to sign out of google chrome as well, but this is where the main problem is. "Your Machine": 1.Login with your google account in Chrome. 2.Change your password. What is the expected behavior? You would expect that your "friend's machine" should be unable to access your saved passwords after changing your main account password. What went wrong? Chrome shows Sync error in your "friend's machine" however the saved passwords still work and are not blocked by the sync error. Check out the attached video to see a demonstration of this. Did this work before? N/A Chrome version: 59.0.3071.115 Channel: n/a OS Version: 10.0 Flash Version:
,
Aug 2 2017
,
Aug 4 2017
Able to reproduce the mentioned behavior. Can someone can dev team please look into this issue to check if we can take it as feature request. Thanks.
,
Aug 4 2017
Thank you for considering this issue. I feel this is security issue for common people. I suggest all private data should be removed as soon as authentication failed in any machine. Looks like simple fix.
,
Aug 7 2017
Thank you for your feedback! It is never recommended that you sign into Chrome on a friend's machine, for precisely this reason (see https://support.google.com/chrome/answer/185277). Once you sync Chrome to your Google Account, the data is tied both to your account *and* to your local profile. If you want to get rid of the data locally, you need to go through the Clear Browsing Data flow (simply signing out of Chrome is not enough, unless you check the box that says "Also remove your existing data from this device"). Simply removing synced data when the user signs out as you suggest (or, equivalently, when the user enters an auth error state) would have unintended consequences for many people. For example, a user may not expect all of their bookmarks to disappear when they sign out of gmail, and may not understand how to get them back. That being said, passwords are a bit of a special case, and we are currently investigating whether there is a better model for syncing passwords that may address the concerns you've raised without introducing surprising behavior for most users. Given all of the above, I'm marking this issue as WontFix, since there's no action to take in the immediate term. Thanks again for your feedback, and I hope that addresses your questions. |
|||
►
Sign in to add a comment |
|||
Comment 1 by avadh...@gmail.com
, Aug 2 2017