Future Chrome version may choose your passwords, and change them when you've been hacked

Google Chrome logoGoogle's Chrome development team is working on a system to automatically generate passwords, which would help users secure their online identities with passwords that would be diversified across different sites, and are randomized and thus harder to guess. Detailed in developer documentation on the Chromium Project site, the system would detect account sign-up pages and "add a small UI element to the password field" giving the user the option of letting Chrome manage the password for them.

Initial versions of the system would create passwords on an individual basis, at the user's request. But Google's development team states that "At some point in the future it might also be possible for us to automatically change all of a user's passwords when we realize that their account is hijacked." The developer documentation notes that the feature would make Google "a higher value hijacking target," than it already is, although "Google is already a high value target so this shouldn't change much."

Chrome can already store passwords, a common feature in modern browsers, and it syncs them across computers, with the passwords encrypted in transit and at rest in Google data centers. The idea of auto-generating passwords is not new, either. Password management software such as 1Password and LastPass can already generate passwords and automatically input them into Web forms. But these tools cost money and require additional software downloads. Although it's not clear when it will become available, Google's scheme would make storing and generating passwords a pre-installed feature of the browser.

The first challenge noted by the Chrome development team is detecting sign-up pages, which is accomplished by looking for elements such as "an account name field and two password fields." Next, the Chrome password generator must come up with a secure password that meets the site's requirements—many sites require digits, special characters or certain lengths. Because the password generator may choose a password that doesn't meet the site's requirements, the user is given a chance to review the suggested password before selecting it.

"If they accept the prompt then we pop up a small box which is prepopulated with what we think is an acceptable random password," the Chromium development document says. "The reason we don't just choose a password for them is that many sites have requirements (e.g. must have one digit, must be alphanumeric, must be between 6 and 20 characters) some of which may be contradictory between sites. So we will choose a default generator that will work on most sites, but users may need to change our password if it doesn't work."

The Chromium team is still looking for a "way to authenticate to the browser to enable this feature," and will have to find a workaround for sites that have autocomplete turned off.

"Any website that has autocomplete turned off will not be able to be protected," the document states. "Going by current phishing attacks, this means that 40-70% of phishing pages can't be protected against. Once this feature is rolled out we probably want to see if we can get around this problem. Maybe we can get users to re-authenticate to the browser before logging into such sites."

How much do you trust Google?

Google is often criticized for invading users' privacy, as the company makes much of its revenue by serving up personalized ads to users based on their Web browsing habits and even the contents of their e-mail. However, the development of technology to generate more secure passwords seems like a good-faith effort to protect users from online attacks, and isn't so far removed from the already-existing practice of browsers storing passwords.

Google's password-generator will likely be appealing to many because of the sheer convenience of it. But users will have to decide for themselves just how much of their online activities they want to trust with Google.

In the long run, Chrome developers say the solution should be browser sign-in coupled with the OpenID authentication standard. However, "getting most sites on the Internet to use OpenID will take a while," the Chrome team states. "In the meantime it would be nice to have a way to achieve the same affect of having the browser control authentication." Since many people re-use passwords across sites, randomization will go a long way toward better security, making it harder for attackers to steal a user's entire online identity.

Source: Ars Technica

Tags: browsers, Chrome, Google

Add comment

Your name:
Sign in with:
Your comment:

Enter code:

E-mail (not required)
E-mail will not be disclosed to the third party

Last news

Galaxy Note10 really is built around a 6.7-inch display
You may still be able to download your content
Facebook, Messenger and Instagram are all going away
Minimize apps to a floating, always-on-top bubble
Japan Display has been providing LCDs for the iPhone XR, the only LCD model in Apple’s 2018 line-up
The 2001 operating system has reached its lowest share level
The entire TSMC 5nm design infrastructure is available now from TSMC
The smartphone uses a Snapdragon 660 processor running Android 9 Pie
The Samsung Galaxy A5 (2017) Review
The evolution of the successful smartphone, now with a waterproof body and USB Type-C
February 7, 2017 / 2
Samsung Galaxy TabPro S - a tablet with the Windows-keyboard
The first Windows-tablet with the 12-inch display Super AMOLED
June 7, 2016 /
Keyboards for iOS
Ten iOS keyboards review
July 18, 2015 /
Samsung E1200 Mobile Phone Review
A cheap phone with a good screen
March 8, 2015 / 4
Creative Sound Blaster Z sound card review
Good sound for those who are not satisfied with the onboard solution
September 25, 2014 / 2
Samsung Galaxy Gear: Smartwatch at High Price
The first smartwatch from Samsung - almost a smartphone with a small body
December 19, 2013 /

News Archive



Do you use microSD card with your phone?
or leave your own version in comments (16)