Chrome password vulnerability

[scottyp123]

I don't know if anyone else has noticed this with the passowrds but it seems quite serious to me. I have a chrome account on various PCs with lots of favourites saved along with the passwords for them as well. I gave one of my old PC's away to a mate a while ago and I made sure I signed out of everything and I deleted all the favourites, I even made sure that the payment details were gone and they was, I didn't check the passwords though.

The PC has gone slightly faulty and I was looking at it tonight, he now has signed into chrome with his own user name but all the old passwords I had are still visible but they are now under his account instead so if he sign's into another PC he now has access to all my sites and all my passwords.

It turns out that even if you sign out of chrome altogether the passwords are still available to look at in the password section of the settings. Give it a try if you don't believe me.

Luckilly I don't think he is too savy when it comes to PC's so I have managed to delete all the passwords from his account and they finally seem to be gone for good but this is a crazy flaw unless I'm missing something and it seems to have been going on for ages.
https://support.google.com/chrome/thread/2119312/p...

Chrome has got to be ditched for a serious flaw like this surely.

[eltawater]

The details are normally bound and stored against your Windows account when stored by the browser, presumably under the assumption that if you can login to the windows account then they're probably your details. Chrome normally challenges me for my windows login password if I try to view a password stored in the passwords section.

Is your mate reusing your user account or is this happening under his own, brand new fresh windows account you created when you handed it over? It's normally a good idea to securely wipe a hard drive and re-install or preferably install a new hard drive and re-install windows to that before letting a machine out of your hands. You'd be surprised just how much stuff can be recovered from the hard drive otherwise.

[bigandclever]

It does sound unusual. I can’t quite work out why the question the OP linked was locked after a very brief flurry of activity over a month, last year. I doubt it’s actually a real issue, but I’m quite trusting

ETA I’ve just read that back, might appear I’m being sniffy though I’m not. Just feels like it would be something the world would know about.

Edited by bigandclever on Wednesday 15th September 20:16

[scottyp123]

I never set a windows password, as it was only used by me at the time I didn't need one. I was going to give him another more up-to-date PC I had lying around but I'll have to re-think that one now.

[scottyp123]

You would think that signing out of chrome would stop people being able to view your passwords though. It stops them from seeing your payment methods.

[eltawater]

scottyp123 said:

I never set a windows password, as it was only used by me at the time I didn't need one. I was going to give him another more up-to-date PC I had lying around but I'll have to re-think that one now.

That sounds like he's still using your windows account then so Chrome will have given him access to your details that way as it doesn't know the difference between him and you, only that the windows account is the same.

[Derek Smith]

I think the moral is the most consistent one of the last few years: don't give away computers with HDDs/SSDs still attached. New ones are cheap enough.

The vulnerability lies not with Chrome I think.

By saving your passwords to Chrome, you are sabotaging all your security checks. Use a password manager.

[scottyp123]

eltawater said:

scottyp123 said:

I never set a windows password, as it was only used by me at the time I didn't need one. I was going to give him another more up-to-date PC I had lying around but I'll have to re-think that one now.

That sounds like he's still using your windows account then so Chrome will have given him access to your details that way as it doesn't know the difference between him and you, only that the windows account is the same.

They aren't really windows accounts though, there is only one PC that I've got where I sign in with a windows password and I had to set that up to download a game from the windows store. The other machines like my laptop and PC in the bedroom just have local windows accounts on them with nothing connecting them windows wise, all the linking is done through chrome.

[scottyp123]

Derek Smith said:

I think the moral is the most consistent one of the last few years: don't give away computers with HDDs/SSDs still attached. New ones are cheap enough.

The vulnerability lies not with Chrome I think.

By saving your passwords to Chrome, you are sabotaging all your security checks. Use a password manager.

There isn't anything too vulnerable on them for me at least tough, just passwords for various sites like this one for eg, I don't save banking passwords, I have them all in my head. Also sites like Amazon don't seem to save the password anyway luckilly.

[eltawater]

scottyp123 said:

eltawater said:

scottyp123 said:

I never set a windows password, as it was only used by me at the time I didn't need one. I was going to give him another more up-to-date PC I had lying around but I'll have to re-think that one now.

That sounds like he's still using your windows account then so Chrome will have given him access to your details that way as it doesn't know the difference between him and you, only that the windows account is the same.

They aren't really windows accounts though, there is only one PC that I've got where I sign in with a windows password and I had to set that up to download a game from the windows store. The other machines like my laptop and PC in the bedroom just have local windows accounts on them with nothing connecting them windows wise, all the linking is done through chrome.

Those are still user accounts on the local Windows installation and Chrome is storing the details for those within that user's directory. So if you have one account named "User" and then a second account name "Scotty", Chrome will store each user's details separately. But you only had one account created and you handed over this account to your mate when you handed him the machine. As there was no password set, he was straight in and Windows / Chrome just assume he is the same as you. It's no different to him being at your house, you getting up out of the seat in front of the PC and him sitting down in front of it.

It's not helpful that Microsoft have conflated the use of a "Microsoft account" to login to your Windows machine with vs a local Windows user account which may be where some of the confusion is.

If your laptop was stolen now and it has no password set anywhere, the thief would probably be able to just turn it on and go straight in as if it were you accessing it.

Edited by eltawater on Wednesday 15th September 21:06

[Terminator X]

I don't save any passwords, job jobbed. Write them on a piece of paper and store near the computer, far less chance of being broken into vs hacked imho.

TX.

[scottyp123]

eltawater said:

Those are still user accounts on the local Windows installation and Chrome is storing the details for those within that user's directory. So if you have one account named "User" and then a second account name "Scotty", Chrome will store each user's details separately. But you only had one account created and you handed over this account to your mate when you handed him the machine. As there was no password set, he was straight in and Windows / Chrome just assume he is the same as you. It's no different to him being at your house, you getting up out of the seat in front of the PC and him sitting down in front of it.

It's not helpful that Microsoft have conflated the use of a "Microsoft account" to login to your Windows machine with vs a local Windows user account which may be where some of the confusion is.

If your laptop was stolen now and it has no password set anywhere, the thief would probably be able to just turn it on and go straight in as if it were you accessing it.

Edited by eltawater on Wednesday 15th September 21:06

That's great but what does the actual google account do then?

I signed out of the google account so it didn't have a user associated with it and the passwords were still visible even with no google user signed in, then he actually created a new account with a different email address entirely and the passwords were still there even then but in addition to that they all became his passwords as well. So if he was to sign in with his google credentials on an entirely different machine then google would download all the passwords onto that copy of chrome as well.

Surely that's a flaw if there ever was one.

[scottyp123]

To be fair I've just tried edge and it behaves in exactly the same way as far as signing out goes.

[eltawater]

scottyp123 said:

That's great but what does the actual google account do then?

I signed out of the google account so it didn't have a user associated with it and the passwords were still visible even with no google user signed in, then he actually created a new account with a different email address entirely and the passwords were still there even then but in addition to that they all became his passwords as well. So if he was to sign in with his google credentials on an entirely different machine then google would download all the passwords onto that copy of chrome as well.

Surely that's a flaw if there ever was one.

• The passwords were created and belonged to the local user account using the browser on the machine.
• The Google account offers to sync those passwords from the local user account into the Google account as a way of making them available to the Google account wherever else it is signed into, for convenience purposes.
• When you sign out of the Google account on the local machine, all it likely does is break that syncing mechanism until you next sign into it.
• As the passwords "belong" to the local Chrome browser on that local machine, signing out likely doesn't clear them because the windows account is still the same.
• When your mate used the same local Windows account and the same Chrome browser to register a new Google account, Chrome then offered to sync those local passwords into that new Google account. As far as it was concerned, the same old local windows user had decided to create a new Google account.
• The security lapse here was handing over the PC with full access to an existing local Windows account and all that came with it. If you had created a new local Windows account for your mate and deleted the existing user account, all the Chrome browsing details / password history / form autocomplete etc) would have been deleted with it.
• Edge is based on Chromium so will operate in a very similar way.

A similar thing would happen if you sold on an old mobile phone with no system reset, no screen lock passcode set and no further authentication required to access any installed apps. The new owner would most likely then be able to open up Facebook, Pistonheads etc and post using your acccount as if they were you as the phone doesn't know any different.

[eeLee]

Chrome profiles are a convenience, not a security feature. It's for people who trust each other and share the same login to a PC.

Don't save your passwords in your Chrome profile, use Bitwarden and install the plugin, it's free.

[e-honda]

If you have google sync on then signing out remotely or via a google service merely pauses it till you next sign in. New stuff will stop going to the device, but anything already synced is in the profile unless it is deleted.
If you disable sync via the browser settings, then it will give you the option to delete the synced data or leave it on the local profile. I think it defaults to leaving it.
It's not a vulnerability but it is a fairly big foot cannon.

It would technically be very difficult to guarantee the confidentially of all synced data without control of the operating system, so instead it relies on the operating system's protection, which if you hand over your login to someone else is none.
You would not really have this issue on a chromebook because your google account is needed to login to the OS, so it would be obvious if you give someone your google account password you are giving them access to everything in your google account.

In google workspace i have the option to remotely wipe a browser profile so can avoid this situation, but this is not guaranteed to succeeded because if the browser is started up offline it doesn't get the signal to wipe.
I don't know why this isn't an option on a personal account.

[Derek Smith]

I change passwords fairly regularly and the irritation is that if you change the passord for a Google account on one device, you then have to change it for all the others. I say irritation, but, if anything, it is a security method.

My tablet went walkabout and it was reassuring to be able to change the password on Google. An irritation when it was discovered in a daughter's house.

[james6546]

I stopped using chrome to remember passwords recently when I realised how unsecure it was.

I've tried a few password managers and Microsoft Authenticator seem to be pretty decent, especially as it's free.

[insert coin]

james6546 said:

I stopped using chrome to remember passwords recently when I realised how unsecure it was.

I've tried a few password managers and Microsoft Authenticator seem to be pretty decent, especially as it's free.

Until Microsoft lock you out of your account and don’t give you a fair and robust appeals system.