Are they encrypted in disk? How? Are they safe, for example, in the event of someone booting from a Live CD and mounting the hard disk?
How is the encryption key generated? Is it different in Windows and Linux?
The passwords are encrypted and stored in a SQLite database:
|show 1 more comment|
They are "encrypted" but it's a reversable encryption. Chrome has to send the raw password to the site it was stored for, so if Chrome can decrypt and use it, so can other people. Storing passwords is never 100% safe.
|show 3 more comments|
You seem to be curious specifically about the key used to encrypt the passwords in Chrome.
The answer is:
And then the encrypted password is stored in the SQLite database file:
You'll notice the password is an encrypted blob of data. The approximate algorithm to encrypt a new password is:
And Chrome saves that blob to its SQLite database.
But to answer your question: Where does the encryption key come from?
The Technical Details
Of course i left out the technical details. Chrome does not encrypt your passwords itself. Chrome does not have a master key used to encrypt anything. Chrome does not do the encryption. Windows does.
There is a Windows function,
So the password:
You'll notice that i never needed to supply a password. That is because Windows takes care of all of that. In the end:
So the only way for someone to know your password is if they know your password.
Google Chrome encrypts passwords and stores them in SQLite DB but they could be easily viewed with the special password recovery applications such as ChromePass (http://www.nirsoft.net/utils/chromepass.html) or SecurePassword Kit (http://www.getsecurepassword.com/)