PrivSec-dev/privsec.dev
1
0
Fork 0
mirror of https://github.com/PrivSec-dev/privsec.dev synced 2025-02-20 18:31:35 -05:00
Code

Update index.md

Browse Source 
updated Powerwash typo

Signed-off-by: Aryun Gupta <38221566+AryunGupta@users.noreply.github.com>
This commit is contained in:
Aryun Gupta 2024-12-30 16:57:34 -07:00 committed by GitHub
parent 252b7db855
commit 68a10c0f4e
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
content/posts/knowledge/ChromeOS Questionable Encryption/index.md
View File

@ -27,12 +27,12 @@ As a result, someone with sufficient access to Google's servers would theoretica
This differs from how encryption passwords are handled by other services like cloud&#8209;based password managers&nbsp;&mdash; they use _client&#8209;side hashing_ to deliberately blind the server from the actual password. As the name suggests, the browser locally executes a cryptographic hash function on the actual password and only transmits the _resultant hash_ to the server for authentication.
The user should be able to avoid this issue with the local password. While we have not done in-depth analysis to confirm that Google never has access to the local encryption password, this is likely the case since an account recovery using the Google password will require a Power Wash:
The user should be able to avoid this issue with the local password. While we have not done in-depth analysis to confirm that Google never has access to the local encryption password, this is likely the case since an account recovery using the Google password will require a Powerwash:
![Power Wash](power-wash.jpg)
![Powerwash](power-wash.jpg)
## Takeaways
If Google is malicious, coerced by the government, or hacked, their servers can record the user password prior to it being hashed server&#8209;side. That password can then be used by an adversary with physical access to unlock ChromeOS and gain access to the data stored therein, if the Google account password is used for encryption.
As a result, when setting up your Chromebook, it is highly recommended that you use a local password instead.
As a result, when setting up your Chromebook, it is highly recommended that you use a local password instead.