Listen to the Podcast:
When registering into a website like Facebook or Twitter, Google Chrome frequently displays a pop-up prompting the user to save their password. At we describe the mechanism used to store and protect passwords and indicate whether it’s safe to select “Save.”
Is It Safe to Save Your Passwords in Google Chrome?
The Google Chrome storage mechanism poses a security risk only if the computer has been previously compromised or exposed, although the use of a database called SQLite3 adds an additional attack vector that could be exploited by cybercriminals, according to ESET, a cyber security firm.
The only known risk associated with this mechanism is the theft of stored credentials. Therefore, it is advised not to use such a database and, if you do, not to retain passwords for essential services that contain personal information, such as:
- On line bank
- Social media
- medical websites
What Happens When You Allow “Store” Your Passwords?
By clicking “accept” when Google Chrome asks “Do you want to save the password? “, the user consents to the saving of the username and password submitted in a website’s login form. This information can be specifically stored in an SQLite3 database located at the following address:
- %LocalAppData%\Google\Chrome\User Data\Default\Login Data.
This database’s tables contain a variety of fields, with the ” logins ” table containing the most sensitive data, including the ” username value ” and ” password value ” fields. These fields are meaningless without the “origin_url” field, which informs Google Chrome which website the credentials correspond to.
The other fields contribute to the mechanism’s correct operation to a lesser extent. Because of fundamental security concerns, passwords are not stored in plain text. On Windows systems, the browser employs an encryption feature provided by the operating system, CryptProtectData (Crypt32.dll), per ESET.
Is There a Real Danger with This Mechanism in Google Chrome?
Google Chrome’s “Save Password” feature is designed so that encrypted data can only be decrypted by the same user who was logged in at the time the password was encrypted. Additionally, it can be configured to only decrypt data on the same computer on which it was encrypted.
The technological behemoth does not use a password set by the user, but rather the user’s operating system credentials. Therefore, a cybercriminal would be compelled to decrypt them by logging in as the same user who created them and transmitting them.
If an attacker gains access to the computer, they could readily obtain and decrypt the plaintext passwords if this mechanism is used to store them.
This type of behavior has been observed in multiple malicious codes, including Latin America-specific banking Trojans designed to capture login credentials for online banking sites.
How Do Attacks with Your Passwords Work?
In these attacks, the cybercriminal can obtain both the structure and the contents of the tables. For instance, they could attempt to log in to Facebook using false credentials and then select the option for Google Chrome to store the credentials.
Once the username and password have been saved to the browser’s database, the user can locate the file that contains this information and access it with a database-viewing program, such as DB Browser for SQL Lite.
From there, they can locate the entries in the ” logins ” table that contain login information, such as:
- URL
- Username
- Encrypted password.
The stored password is encrypted in a BLOB structure (binary large objects, such as images or audio files), and the program displays its hexadecimal representation when the user clicks on that field.
The perpetrator now has the encrypted username, website, and password, and only needs to decrypt it. Since the active user is likely to be the same one who previously saved the password, an attacker with access to the computer in question can easily decrypt the password using Crypt Unprotect Data as opposed to DB Browser.
Anyone with physical or remote access to the computer can perform these actions, so it’s important to use a strong and unique password for each account, enable two-factor authentication, exercise caution when allowing Google Chrome to save passwords, and keep your computer’s security up to date, according to ESET.
