<div dir="ltr"><div dir="ltr"><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sat, Jun 12, 2021 at 1:31 PM Christopher Morrow <<a href="mailto:morrowc.lists@gmail.com">morrowc.lists@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div dir="ltr"><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sat, Jun 12, 2021 at 1:21 PM Tom Beecher <beecher@beecher.cc> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">They<br>snuck it on me.<br></blockquote><div><br></div><div>"I didn't notice this until now" != "They snuck one by the goalie."</div><div><br></div></div></blockquote><div><br></div><div>actually, i was wondering while reading this thread...</div><div>(I mean this for clarity sake, not in a 'blame the victim' sort of way"</div><div><br></div><div>"Did William think that password data, which had to be in plaintext to auto-fill forms/etc, was</div><div>stored on the local device(s) only?"</div><div><br></div><div>I suppose some scheme like:</div><div> 1) keep local copies in hashed/encrypted store</div><div> 2) upload said store to 'cloud' periodically (on change?)</div><div> 3) download on new device / clear-all-browser-data events</div><div><br></div><div>If the hashed pile of data is 'simply' encrypted with 'gmail/google account password'</div><div>(or that and some token from 'cloud') and decrypted in some form of javascript functions...</div><div><br></div><div>Then only the local browser really knows the content of the hash-file, right?</div><div>NOTE: I have no idea how chrome does it's thing here... but I expect the code is</div><div>visible on <a href="http://chromium.org" target="_blank">chromium.org</a> ? Perhaps even here:<br> <a href="https://source.chromium.org/chromium/chromium/src/+/main:chrome/browser/password_manager/" target="_blank">https://source.chromium.org/chromium/chromium/src/+/main:chrome/browser/password_manager/</a> </div><div><br></div><div>would be a good place to go digging into the code / hows / whys / where-fores ?</div><div><br></div></div></div></blockquote><div><br></div><div>The source.chromium site is neat, this query, for instance, finds where '<a href="http://passwords.google.com">passwords.google.com</a>' is in the code tree:<br> <a href="https://source.chromium.org/search?q=passwords.google.com&sq=&ss=chromium%2Fchromium%2Fsrc:chrome%2Fbrowser%2Fpassword_manager%2F">https://source.chromium.org/search?q=passwords.google.com&sq=&ss=chromium%2Fchromium%2Fsrc:chrome%2Fbrowser%2Fpassword_manager%2F</a></div><div><br></div><div>as a method to help track down the wherefores...</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div class="gmail_quote"><div></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div></div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sat, Jun 12, 2021 at 10:30 AM William Herrin <<a href="mailto:bill@herrin.us" target="_blank">bill@herrin.us</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On Sat, Jun 12, 2021 at 5:11 AM K. Scott Helms <<a href="mailto:kscott.helms@gmail.com" target="_blank">kscott.helms@gmail.com</a>> wrote:<br>
> Encryption != plain text, just because it's not a hash doesn't mean it's problematic (if done correctly).<br>
<br>
Scott, Google's computer is able to compose an html document which<br>
contains my passwords in plain text. Whatever dance they do to either<br>
side of that point in their process, at that point they possess my<br>
passwords in plain text. Why is this concept a mystery to anyone?<br>
<br>
<br>
> This is the exact same method that every single password management system uses and all are far better for the average user than trying to reuse a single password or write them down.<br>
<br>
If I had authorized it, it would indeed be just like any other<br>
password managing web site. I did not knowingly authorize it. They<br>
snuck it on me.<br>
<br>
Regards,<br>
Bill Herrin<br>
<br>
<br>
-- <br>
William Herrin<br>
<a href="mailto:bill@herrin.us" target="_blank">bill@herrin.us</a><br>
<a href="https://bill.herrin.us/" rel="noreferrer" target="_blank">https://bill.herrin.us/</a><br>
</blockquote></div>
</blockquote></div></div>
</blockquote></div></div>