<http://schema.org/articleBody>
"The other day, I was using Chrome in development for an Ember.js app. I use Safari for day-to-day browsing, but it has a habit of aggressively caching files when I least expect it, so from time to time I switch to Chrome.\nI decided to hit Chrome\u2019s \u201Cimport bookmarks now\u201D link and see if I could import my bookmarklets from Safari, so things would be nice and consistent between the two browsers. I didn\u2019t expect to get this:\n\nThis struck me as particularly odd. Why is \u201Csaved passwords\u201D greyed out, and mandatory? Why have a check-box? This is the illusion of choice. I think it\u2019s deeply misleading, and here's why...\nThis is a page in Chrome\u2019s settings panel:\n\nSee that \u201Cshow\u201D button? It does what you think it does.\n\nThere\u2019s no master password, no security, not even a prompt that \u201Cthese passwords are visible\u201D. Visit chrome://settings/passwords in Chrome if you don\u2019t believe me.\nThere are two sides to this: the developer and the user. Both roles have vastly different opinions as to how the computer works. Any time I try to draw attention to this, I get the usual responses from technical people:\n\nJust use 1Pass.\nThe computer is already insecure as soon as you have physical access.\nThat\u2019s just how password management works.\n\nWhile all of these points are valid, this doesn\u2019t address the real problem: Google isn\u2019t clear about its password security.\nIn a world where Google promotes its browser on YouTube, in cinema pre-rolls and on billboards, the clear audience is not developers. It\u2019s the mass market \u2014 the users, the overwhelming majority. They don\u2019t know it works like this. They don\u2019t expect it to be this easy to see their passwords. Every day, millions of normal, everyday users save their passwords in Chrome. This is not OK.\n\nThis dialog is even more misleading. By using words like \u201Cconfidential information\u201D and \u201Cstored in your keychain,\" OSX describes the state of your saved password\u2019s current security. It\u2019s the very security Chrome is about to bypass by displaying your passwords in plain-text, outside your keychain, without requiring a password. When you visit a website, Chrome prompts for every password it can find for that domain.\nToday, ask somebody who isn't tech-savvy to borrow his or her computer. Visit chrome://settings/passwords and click \u201Cshow\u201D on a few of the rows. See what they have to say.\nUPDATE: Justin Schuh, head of Chrome security, says I\u2019m wrong, and this is not going to change.\nElliott Kember is a software developer and director at Riot. This article was originally published on his personal blog.\nMashable composite. Image: iStockphoto, nikicruz"^^<http://www.w3.org/2001/XMLSchema#string>
<http://mashable.com/2013/08/07/chrome-password-security/>