Authenticator-Extension / Authenticator-Extension/Authenticator

Google Chrome stores TOTP codes in plaintext

Open
#1,464 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
TypeScript
Stars
4.7k
Forks
1.2k
PR merge metrics
No merged PRs in 30d

Description

### Describe the issue

1. Start a new virgin copy of Google Chrome.
2. Install Authenticator.cc.
3. Open Authenticator, go to settings, go to Security, set a password.
4. Click pencil and '+' to add a new TOTP code.
5. Select Manual Entry.
6. In Issuer type "Test:Test". In Secret type "deadbeefdeadbeef". Optionally set a user name.
7. Press OK.
8. In a terminal:
```
strings $HOME/.config/google-chrome/Default/Sync\ Extension\ Settings/bhghoamapcdpbohphigoooaddinpkbai/000003.log | grep Test
{"account":"Test","dataType":"OTPStorage","encrypted":false,"hash":"20a08da0-dc26-4226-a253-4d2291a7fa64","index":0,"issuer":"Test:Test","secret":"deadbeefdeadbeef","type":"totp"}u}
```
9. Observe that the secret is available in plaintext even though we set an encryption password. This means that an attacker with access to your terminal could extract the TOTP secret, which is what the password is meant to prevent.

### Browser

Chrome

### Browser Version

140.0.7339.80

### Extension Version

8.0.1

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.