Key for chromium's encrypted cookies store in Linux is “peanuts”
1–10 of 59 posts
Re: Key for chromium's encrypted cookies store in Linux is “peanuts”
#2Some more details from the source:
Password is: "peanuts" Salt is: "saltysalt" Algorithm used: AES-128-CBC The number of KDF iterations is: 1
Edit: Indicate that no. of iterations is for the Key Derivation Function
Re: Key for chromium's encrypted cookies store in Linux is “peanuts”
#3"ksalt - at least salt is a variable, surely it at least is randomly generated, right?"
> // Salt for Symmetric key derivation.
> const char kSalt[] = "saltysalt";
Re: Key for chromium's encrypted cookies store in Linux is “peanuts”
#4"ksalt - at least salt is a variable, surely it at least is randomly generated, right?" > // Salt for Symmetric key derivation. > const char kSalt[] = "saltysalt";
Reading this was like seeing a ray of hope being shot down by a minigun.
In seriousness, what gives!? Why are these so simple? Surely a development base as large as Chromium's could pick up on something like this.
Re: Key for chromium's encrypted cookies store in Linux is “peanuts”
#5Well without having a user-specified master password like firefox has, you're bound to use some "pseudosecret" keys.
Re: Key for chromium's encrypted cookies store in Linux is “peanuts”
#6I guess a lot of others are also wondering, "What's the point?"
If an attacker can read the file the cookies are stored in, you have already lost.
It even mentions "obfuscation" - which might be a slight obstacle if this was closed-source - but Chromium is open-source.
Re: Key for chromium's encrypted cookies store in Linux is “peanuts”
#7I guess a lot of others are also wondering, "What's the point?" If an attacker can read the file the cookies are stored in, you have already lost. It even mentions "obfuscation" - which might be a slight obstacle if this was closed-source - but Chromium is open-source.
Obfuscation is still useful.
For example if a sysadmin is investigating a problem they're less likely to accidentally see a user's data in human-readable form, it also provides a level of defence against unsophisticated attackers.
Re: Key for chromium's encrypted cookies store in Linux is “peanuts”
#8I guess a lot of others are also wondering, "What's the point?" If an attacker can read the file the cookies are stored in, you have already lost. It even mentions "obfuscation" - which might be a slight obstacle if this was closed-source - but Chromium is open-source.
Obfuscation is still useful. For example if a sysadmin is investigating a problem they're less likely to accidentally see a user's data in human-readable form, it also provides a level of defence against unsophisticated attackers.
[deleted]
Re: Key for chromium's encrypted cookies store in Linux is “peanuts”
#9Well without having a user-specified master password like firefox has, you're bound to use some "pseudosecret" keys.
You can use unique password stored in the protected system storage (like OS X Keychain) so at least user is protected from non-root users.
Re: Key for chromium's encrypted cookies store in Linux is “peanuts”
#10Some more details from the source: Password is: "peanuts" Salt is: "saltysalt" Algorithm used: AES-128-CBC The number of KDF iterations is: 1 Edit: Indicate that no. of iterations is for the Key Derivation Function
I don't know too much about this so I'm a bit confused. What does a salt do if it's the same for everything?