Google clamps down on password security in Chrome 'Canary'

Reaction to August brouhaha over Chrome's practice of letting anyone see passwords in plain text

Google has begun work on shutting a hole in its Chrome browser that lets casual thieves steal website and Web service passwords.

According to Franois Beaufort, who frequently uncovers new features and changes in early builds of Google's browser, the "Canary" version of Chrome for OS X now includes a setting that locks down saved passwords.

By clicking 'Enable' in the 'chrome://flags' screen of Canary on the Mac, users can lock down password viewing.

Canary is the name for the very-earliest version of the browser, one still in the Chromium channel, the open-source project that feeds code to Chrome.

By setting a special flag in Canary on the Mac, anyone who tries to view browser-saved passwords will instead be asked to enter the OS X user account password.

Computerworld confirmed that, once the flag is set, Canary will not show saved passwords in plain text without the additional OS X user account password, the same one needed to make major changes in the operating system's settings or approve the installation of software.

To set the flag, users must enter "chrome://flags" (minus the quotation marks) in the browser's address bar, then change the setting "Password Manager Reauthentication Mac" by clicking on the "Enable" link. The change takes effect after the browser is relaunched.

The additional security is a reaction to an August kerfuffle after software developer Elliott Kember noticed that Chrome let anyone with physical access to a computer easily spy and snoop on saved passwords.

Chrome had always handled passwords in that way -- letting anyone with access view passwords saved by the browser -- but the explosion of commentary on the topic signaled that few knew as much.

For its part, Google defended the practice, with Jason Shuh, the browser's security tech lead, saying, "We don't want to provide users with a false sense of security, and encourage risky behavior" when asked why Chrome did not require a second level of authentication. "We want to be very clear that when you grant someone access to your OS user account, that they can get at everything. Because in effect, that's really what they get," Shuh said then.

Other security experts disagreed, and urged Google to do something.

Features added to Canary usually, although not always, make it into the Dev channel -- the roughest-edged of Chrome's three distributions -- and from there into the Beta and Stable channels.

Google did not immediately reply to questions, including whether the OS X change would be adopted by Chrome on its other platforms, Windows and Linux, and when users could expect the additional authentication option to reach the production-grade build, Chrome Stable.

Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, on Google+ or subscribe to Gregg's RSS feed. His email address is

See more by Gregg Keizer on

Read more about application security in Computerworld's Application Security Topic Center.

Join the CSO newsletter!

Error: Please check your email address.

Tags Googlesecurityapplication securityAccess control and authenticationinternet

More about AppleGoogleLinuxMicrosoftTopic

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Gregg Keizer

Latest Videos

  • 150x50

    CSO Webinar: Will your data protection strategy be enough when disaster strikes?

    Speakers: - Paul O’Connor, Engagement leader - Performance Audit Group, Victorian Auditor-General’s Office (VAGO) - Nigel Phair, Managing Director, Centre for Internet Safety - Joshua Stenhouse, Technical Evangelist, Zerto - Anthony Caruana, CSO MC & Moderator

    Play Video

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

More videos

Blog Posts

Market Place