up vote 5 down vote favorite
2
share [g+] share [fb]

Are they encrypted in disk? How? Are they safe, for example, in the event of someone booting from a Live CD and mounting the hard disk?

How is the encryption key generated? Is it different in Windows and Linux?

link|improve this question
feedback

2 Answers

up vote 5 down vote

The passwords are encrypted and stored in a SQLite database:

The important piece here is CryptProtectData, which is a Windows API function for encrypting data. Data encrypted with this function is pretty solid. It can only be decrypted on the same machine and by the same user that encrypted it in the first place.

link|improve this answer
But how is the encryption key generated? Depending on this I would consider the scheme more or less secure. And what about Linux? – Óscar May 29 '10 at 18:39
@Óscar: On Windows, CryptProtectData uses your Windows credentials (not the password, but some other data) as the key. AFAIK, it's the same function used to protect your certificates, network credentials and all that stuff. – grawity May 29 '10 at 19:23
2  
@Óscar: On Linux, Encryptor::EncryptString does not do anything. There seems to be code for using GNOME Keyring and KDE Wallet. – grawity May 29 '10 at 19:38
feedback
up vote 1 down vote

They are "encrypted" but it's a reversable encryption. Chrome has to send the raw password to the site it was stored for, so if Chrome can decrypt and use it, so can other people. Storing passwords is never 100% safe.

link|improve this answer
But which is the encryption key? – Óscar May 29 '10 at 18:38
Check the answer of sblair. Note that there is a possibility of decryption, no matter how it is stored. With the proper software, anyone could decrypt it. When you have logged into your Windows account until the moment you log out, your passwords are completely usable and completely viewable. Just indicating that there is not a 100% safe solution of storing browser passwords. – BloodPhilia May 29 '10 at 18:39
Well, if for example the encryption key is my password in a Linux system then the password database cannot be decrypted without knowing it (or by brute force). – Óscar May 29 '10 at 18:42
No but if your computer is hijacked/infected, browser passwords could easily be recovered without you noticing. Once again, all I'm pointing out is that there's no 100% failproof password storage for browsers... Just answering your question about their safety. – BloodPhilia May 29 '10 at 18:48
1  
This should provide you with an explanation of its workings: msdn.microsoft.com/en-us/library/ms995355.aspx – BloodPhilia May 29 '10 at 19:02
show 3 more comments
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.