Google Chrome browser helps in password management by prompting users to remembe

Question

Google Chrome browser helps in password management by prompting users to remember their passwords for the websites. These saved passwords can be accessed from the browsers "settings" menu, and to do so chrome asks user for the Windows password. I understand this is for providing more security.

I read somewhere that the Windows password is hashed using NTLM hash. In order to view the saved passwords in chrome, I have to provide my windows password, which is fine. I believe that the chrome must be encrypting the saved passwords using my Windows password.

Now the question is how the chrome automatically fills the web page with the saved password without prompting me for the Windows password. How does chrome decrypt the saved password for the website? This is really confusing.

Is my windows password not hashed and chrome has access to it for decrypting the saved passwords? or does the chrome save passwords in plain without any encryption? Please help.

Explanation / Answer

On Windows, your Chrome saved passwords are encrypted using DPAPI. This mechanism ultimately derives a key from your Windows account password to keep the data secure, and so once you've logged in, the data can be decrypted by applications that rely on this store.

So, Chrome doesn't have access to your Windows account password at all. It relies on the fact that you're logged in be able to access the decrypted password data for filling in the password fields for forms. If you try to view your saved passwords, because there are clearly very sensitive pieces of data it has you enter your password, and Windows verify that it's correct to better assure that not only is it you who are logged in, but also you who are currently sitting in front of your computer at this moment, because you're the only one who should know that password. So, at this point, it doesn't actually need the password to decrypt the data, it's just a security measure to help protect your passwords from casual prying eyes.

Related Questions

Navigate

• Browse (All)
• Browse G
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.