PrivSec-dev/privsec.dev
1
0
Fork 0
mirror of https://github.com/PrivSec-dev/privsec.dev synced 2024-09-07 19:53:30 -04:00
Code

ChromeOS's Questionable Encryption (#222)

Browse Source 
* ChromeOS's Questionable Encryption

Signed-off-by: Tommy <contact@tommytran.io>

* Add metadata

Signed-off-by: Tommy <contact@tommytran.io>

* Minor fixes

Signed-off-by: Tommy <contact@tommytran.io>

* Minor fix

Signed-off-by: Tommy <contact@tommytran.io>

* Update ChromeOS Questionable Encryption.md

Signed-off-by: Tommy <contact@tommytran.io>

* Update ChromeOS Questionable Encryption

* Fix link

* Edits

---------

Signed-off-by: Tommy <contact@tommytran.io>
Co-authored-by: wj25czxj47bu6q <git@wj25.xn--q9jyb4c>
Co-authored-by: wj25czxj47bu6q <96372288+wj25czxj47bu6q@users.noreply.github.com>
This commit is contained in:
Tommy 2024-04-25 22:32:31 -07:00 committed by GitHub
parent d2f1ab85ba
commit 365c717bc1
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 30 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
content/posts/knowledge/ChromeOS Questionable Encryption/google-login.jpg Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 278 KiB

30
content/posts/knowledge/ChromeOS Questionable Encryption/index.md Normal file
View File

@ -0,0 +1,30 @@
---
title: "ChromeOS's Questionable Encryption"
date: 2024-04-25
tags: ['Operating Systems', 'ChromeOS', 'Security']
author: Tommy
---
## Premise
ChromeOS encrypts user data on the disk by default. The implementation details are [documented upstream](https://www.chromium.org/developers/design-documents/tpm-usage/#TOC-Protecting-User-Data-Encryption-Keys "TPM Usage — The Chromium Projects") but not relevant within the scope of this post.
It is well-known that ChromeOS uses Google account passwords as the primary login credentials. This necessarily means that anyone with knowledge of the Google account password is able to unlock and therefore decrypt a ChromeOS user profile.
## Practical Implications
The very same Google account passwords used for ChromeOS authentication are also used for logging in to various Google services in web browsers and other apps. After a quick investigation with browser dev tools:
![Google Login](google-login.jpg)
&hellip;It turns out that passwords are submitted to Google servers in plaintext (see "mygloriouspassword" in the Form Data).
As a result, someone with sufficient access to Google's servers would theoretically be able to obtain the actual, unhashed password for a given Google account. An adversary with physical access would be able to unlock and decrypt ChromeOS user data with cooperation from Google.
This differs from how encryption passwords are handled by other services like cloud&#8209;based password managers&nbsp;&mdash; they use _client&#8209;side hashing_ to deliberately blind the server from the actual password. As the name suggests, the browser locally executes a cryptographic hash function on the actual password and only transmits the _resultant hash_ to the server for authentication.
## Takeaways
If Google is malicious, coerced by the government, or hacked, their servers can record the user password prior to it being hashed server&#8209;side. That password can then be used by an adversary with physical access to unlock ChromeOS and gain access to the data stored therein.
Just to be clear, this is not a vulnerability. It's just how the system is designed.