Hi team,

Chrome browser's password saving mechanism asks for Windows password (if the password is set for Windows login) before revealing the saved passwords.

This gives the user a sense of protection. Like many users, I used to think that chrome use this master password (windows password) to encrypt the saved password and a malware can't steal saved plaintext passwords without knowing the master password.

But, recently I was testing a post-exploitation password retrieval tool on my system (tool: https://github.com/AlessandroZ/LaZagne) which revealed all my saved chrome passwords despite having a master password.

Don't you think, either you should encrypt the passwords using this master password or at least warn the users that it is not providing any protection to saved cleartext passwords from a malware?

In encrypted form, even if the system is compromised, at least saved crdentials in chrome will stay safe. Even if the attacker elevates to local admin level and dumps the hashes, he still has to crack those to get the master password. 

I am using Chrome Version 61.0.3163.100 for Windows.

Thanks!