36

I understand that we are really tempted to save our passwords in Google Chrome. The likely benefit is two fold,

  • You don't need to (memorize and) input those long and cryptic passwords.
  • These are available where ever you are once you log in to your Google account.

The last point sparked my doubt. Since the password is available anywhere, the storage must in some central location, and this should be at Google.

Now, my simple question is, can a Google employee see my passwords?

Searching over the Internet revealed several articles/messages.

There are many more (including this one at this site), mostly along the same line, points, counter-points, huge debates. I refrain from mentioning them here, simply carry a search if you want to find them.

Coming back to my original query, can a Google employee see my password? Since I can view the password using a simple button, definitely they can be unhashed (decrypted) even if encrypted. This is very different from the passwords saved in Unix-like OS's where the saved password can never be seen in plain text.

They use a one-way encryption algorithm to encrypt your passwords. This encrypted password is then stored in the passwd or shadow file. When you attempt to login, the password you type in is encrypted again and compared with the entry in the file that stores your passwords. If they match, it must be the same password, and you are allowed access. Thus, a superuser can change my password, can block my account, but he can never see my password.

5
  • 6
    You can't ““unhash”” a string. Cryptographic hash functions are one-way they are designed to be infeasible (i.e., taking so long to do that by the time you get it done, it won't matter anymore) to reverse. The *nix ““one-way encryption algorithm”” IS a hash function. Oct 7, 2013 at 14:07
  • Thanks, somehow I got carried away. I wanted to mean decrypt.
    – Masroor
    Oct 7, 2013 at 14:39
  • As long as those passwords are not used for WiFi on Android too, you should be save. I've to say this, as Google knows your WiFi passes used on Android.
    – math
    Oct 9, 2013 at 13:35
  • @math Would you like to elaborate that a bit? Somehow failed to comprehend fully.
    – Masroor
    Oct 9, 2013 at 13:37
  • There are many news sites dealing with this topic, just use a search machine with: "Wifi passwords google android" done. E.g. gizmodo.com/…
    – math
    Oct 9, 2013 at 14:24

3 Answers 3

34

Short answer: No*

Passwords stored on your local machine can be decrypted by Chrome, as long as your OS user account is logged in. And then you can view those in plain text. At first this seems horrible, but how did you think auto-fill worked? When that password field gets filled in, Chrome must insert the real password into the HTML form element - or else the page wouldn't work right, and you could not submit the form. And if the connection to the website is not over HTTPS, the plain text is then sent over the internet. In other words, if chrome can't get the plain text passwords, then they are totally useless. A one way hash is no good, because we need to use them.

Now the passwords are in fact encrypted, the only way to get them back to plain text is to have the decryption key. That key is your Google password, or a secondary key you can set up. When you sign into Chrome and sync the Google servers will transmit the encrypted passwords, settings, bookmarks, auto-fill, etc, to your local machine. Here Chrome will decrypt the information and be able to use it.

On Google's end all that info is stored in its encrpyted state, and they do not have the key to decrypt it. Your account password is checked against a hash to log in to Google, and even if you let chrome remember it, that encrypted version is hidden in the same bundle as the other passwords, impossible to access. So an employee could probably grab a dump of the encrypted data, but it wouldn't do them any good, since they would have no way to use it.*

So no, Google employees can not** access your passwords, since they are encrypted on their servers.


* However, do not forget that any system that can be accessed by an authorized user can be accessed by an unauthorized user. Some systems are easier to break than other, but none are fail-proof. . . That being said, I think I will trust Google and the millions they spend on security systems, over any other password storage solution. And heck, I'm a wimpy nerd, it would be easier to beat the passwords out of me than break Google's encryption.

** I am also assuming that there isn't a person who just happens to work for Google gaining access to your local machine. In that case you are screwed, but employment at Google isn't actually a factor any more. Moral: Hit Win + L before leaving machine.

5
  • 3
    Win + L does not work for me since I am a Linux user. But thanks, I am in the habit of never locking my machine when leaving.
    – Masroor
    Oct 7, 2013 at 8:49
  • Well it's the sentiment that's important. And for non windows users, I'm sure there's an easy way to create a lock hotkey.
    – zeel
    Oct 7, 2013 at 12:11
  • 6
    Most linuxes use Ctl-Alt-L to lock the machine. I've even before used a utility that locked by using the bluetooth to detect the presence/absence of my phone. Oct 7, 2013 at 13:28
  • If my Google password is the key used to decrypt the other passwords that Google stores for me, wouldn't Google have to ask for my Google password every time they want to auto fill one of my other passwords? Since they do not do this, it makes me think that my Google password is not the key, since Google supposedly does not store my actual Google password anywhere. So what is the key? Mar 18, 2018 at 3:14
  • Your local instance of Chrome keeps a copy of all the passwords. I'm not an expert on how exactly this system works, and it may change significantly over time. As far as I am aware, your Google password (or other key if you set one up) needs to be used to decrypt your data when you first initialize a Chrome installation. I assume your machine stores the password or key for future use, so you do not need to re-enter it, but it is not stored on Google's server.
    – zeel
    Mar 19, 2018 at 2:36
13

Actually, it's pretty trivial to retrieve your passwords from most browsers. The insane password security article was written by someone who uses mainly Safari, and seems to think that HAS to be the right way. This is user level security by obscurity. The person who brought up the issue is an developer who does mainly iOS, OS X and web development, not security development, and you might want to read Google's counterarguement too

On Windows, this tool from Nirsoft handily lets me snarf all your passwords from multiple browsers. If someone has physical access to your system, it's too late.

And no, it's unlikely Google would allow its employees to see your passwords - the actual synchronization part of the browser is encrypted - either using your login credentials, or your own passphrase. Google as such doesn't have an unencrypted copy of your password. It's good practice since it prevents leaks of said passwords, the temptation to do a little loveint, and from governments to demand that Google hands over passwords. You can't tattle what you don't know.

If you're really worried, just use a third party password manager and sync it whatever way you trust, or use a less common web browser (which these tools don't support) with a master password. Nonetheless, the argument that plain text password storage is not very useful in the day where GPU accelerated password cracking is available.

9

Theoretically not. See https://support.google.com/chrome/answer/1181035 for more details, but basically your synced data (passwords, bookmarks, history, etc.) are encrypted before they're sent to Google's servers. The encryption uses either your Google account password, or a separate password you choose just for the purpose of syncing. In order to keep things synced without having to type in that password all the time, the sync password does have to be stored on your local computer.

For a Google employee to see your passwords (assuming they don't have access to your local machine), they'd have to know the Google account password or your sync password. I'd assume the Google account password is stored in some kind of hashed form on their side, so that wouldn't let them readily decrypt your synced data.

Just to be clear, there are two distinct password storage issues when it comes to Chrome. One is how passwords are stored locally, and your various links talk about how those passwords can easily be viewed if someone can gain access to your local account. The other issue is what I've discussed above, namely how passwords are sent up to Google's servers, so that they can be available across multiple Chrome installations.

1
  • 1
    To add to jjlin's answer: This doesn't mean physical access, it just means access in some way that allows a person access to a file on your computer (such as a virus)
    – Jon
    Oct 7, 2013 at 1:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .