From 6e6cd0416bf60d34537dfe06729549fe9b563d22 Mon Sep 17 00:00:00 2001 From: wj25czxj47bu6q Date: Thu, 25 Apr 2024 11:06:05 +0000 Subject: [PATCH] Edits --- .../knowledge/ChromeOS Questionable Encryption/index.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/content/posts/knowledge/ChromeOS Questionable Encryption/index.md b/content/posts/knowledge/ChromeOS Questionable Encryption/index.md index 6f60132..c55c60e 100644 --- a/content/posts/knowledge/ChromeOS Questionable Encryption/index.md +++ b/content/posts/knowledge/ChromeOS Questionable Encryption/index.md @@ -17,12 +17,14 @@ The very same Google account passwords used for ChromeOS authentication are also ![Google Login](google-login.jpg) -…it turns out that passwords are submitted to Google servers in plaintext (see "mygloriouspassword" in the Form Data). As a result, someone with sufficient access to Google's servers would theoretically be able to obtain the actual, unhashed password for a given Google account. It follows that an adversary with physical access would be able to unlock and decrypt ChromeOS user data with cooperation from Google. +…It turns out that passwords are submitted to Google servers in plaintext (see "mygloriouspassword" in the Form Data). -This differs from how encryption passwords are handled by other services like cloud‑based password managers — using _client‑side hashing_. Client‑side hashing is a technique to deliberately blind the server from the actual password. As the name suggests, the browser locally executes a cryptographic hash function on the actual password and only transmits the _resultant hash_ to the server for authentication. +As a result, someone with sufficient access to Google's servers would theoretically be able to obtain the actual, unhashed password for a given Google account. An adversary with physical access would be able to unlock and decrypt ChromeOS user data with cooperation from Google. + +This differs from how encryption passwords are handled by other services like cloud‑based password managers — they use _client‑side hashing_ to deliberately blind the server from the actual password. As the name suggests, the browser locally executes a cryptographic hash function on the actual password and only transmits the _resultant hash_ to the server for authentication. ## Takeaways -If Google is malicious, coerced by the government, or hacked, their servers can record the user password prior to it being hashed. That password can then be used to gain access to the files on ChromeOS hardware if the adversary gains physical access. +If Google is malicious, coerced by the government, or hacked, their servers can record the user password prior to it being hashed server‑side. That password can then be used by an adversary with physical access to unlock ChromeOS and gain access to the data stored therein. Just to be clear, this is not a vulnerability. It's just how the system is designed. \ No newline at end of file