Chrome does something interesting when you first run it.
The other day, I was using Chrome in development for an Ember.js app. I use Safari for day-to-day browsing, but it has a habit of aggressively caching files when I least expect it, so from time to time I switch to Chrome.
I decided to hit Chromes Import bookmarks now link and see whether I could import my bookmarklets from Safari, so things would be nice and consistent between the two browsers. I didnt expect this:
This struck me as particularly odd. Why is Saved passwords greyed out, and mandatory? Why have a check-box? This is the illusion of choice. I think its deeply misleading, and this is why:
This is a page in Chromes settings panel:
See that show button? It does what you think it does.
Theres no master password, no security, not even a prompt that these passwords are visible. Visit chrome://settings/passwords in Chrome if you dont believe me.
There are two sides to this. The developers side, and the users side. Both roles have vastly different opinions as to how the computer works. Any time I try to draw attention to this, I get the usual responses from technical people:
- Just use 1Pass
- The computer is already insecure as soon as you have physical access
- Thats just how password management works
While all of these points are valid, this doesnt address the real problem: Google isnt clear about its password security.
In a world where Google promotes its browser on YouTube, in cinema pre-rolls, and on billboards, the clear audience is not developers. Its the mass market - the users. The overwhelming majority. They dont know it works like this. They dont expect it to be this easy to see their passwords. Every day, millions of normal, every-day users are saving their passwords in Chrome. This is not okay.
This dialog is even more misleading. By using words like confidential information and stored in your keychain, OSX describes the state of your saved passwords current security. Its the very security Chrome is about to bypass, by displaying your passwords, in plain-text, outside your keychain, without requiring a password. When you visit a website, Chrome prompts for every password it can find for that domain.
Today, go up to somebody non-technical. Ask to borrow their computer. Visit chrome://settings/passwords and click show on a few of the rows. See what they have to say.
I bet you it wont be Thats how password management works.
Updates:
Justin Schuh who is head of Chrome security and called me a novice, says Im wrong, and that this is not going to change.
Sir Tim Berners-Lee is with me. Is there a higher authority?
This is Googles page on saving passwords. Nothing about this feature. Why?
Covered in the press by:
- The Guardian twice.
- The Independent
- The Telegraph
- Reposted on Mashable and Gizmodo
- Accidental Tech Podcast nailed it
- Wired didnt read the article properly
- Thomas Fuchs drew an excellent diagram
