{"action":"created","issue":{"url":"https://api.github.com/repos/passwordmaker/chrome-passwordmaker/issues/143","labels_url":"https://api.github.com/repos/passwordmaker/chrome-passwordmaker/issues/143/labels{/name}","comments_url":"https://api.github.com/repos/passwordmaker/chrome-passwordmaker/issues/143/comments","events_url":"https://api.github.com/repos/passwordmaker/chrome-passwordmaker/issues/143/events","html_url":"https://github.com/passwordmaker/chrome-passwordmaker/issues/143","id":54120570,"number":143,"title":"Sync password is only security through obscurity","user":{"login":"multiwebinc","id":901732,"avatar_url":"https://avatars.githubusercontent.com/u/901732?v=3","gravatar_id":"","url":"https://api.github.com/users/multiwebinc","html_url":"https://github.com/multiwebinc","followers_url":"https://api.github.com/users/multiwebinc/followers","following_url":"https://api.github.com/users/multiwebinc/following{/other_user}","gists_url":"https://api.github.com/users/multiwebinc/gists{/gist_id}","starred_url":"https://api.github.com/users/multiwebinc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/multiwebinc/subscriptions","organizations_url":"https://api.github.com/users/multiwebinc/orgs","repos_url":"https://api.github.com/users/multiwebinc/repos","events_url":"https://api.github.com/users/multiwebinc/events{/privacy}","received_events_url":"https://api.github.com/users/multiwebinc/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":16,"created_at":"2015-01-12T23:06:20Z","updated_at":"2015-01-16T00:40:18Z","closed_at":null,"body":"Just as the title says, the sync password can easily be circumvented and is therefore only security through obscurity.\r\n\r\nSteps to reproduce:\r\n\r\n1. Disable syncing\r\n2. Bring up Chrome's console\r\n3. Click on resources > Local Storage > chrome-extension://... > sync_profiles\r\n4. Change false to true\r\n5. Refresh the page, and voila! All your accounts are there.\r\n\r\nEither this should actually encrypt the settings properly or it should be removed."},"comment":{"url":"https://api.github.com/repos/passwordmaker/chrome-passwordmaker/issues/comments/70190244","html_url":"https://github.com/passwordmaker/chrome-passwordmaker/issues/143#issuecomment-70190244","issue_url":"https://api.github.com/repos/passwordmaker/chrome-passwordmaker/issues/143","id":70190244,"user":{"login":"multiwebinc","id":901732,"avatar_url":"https://avatars.githubusercontent.com/u/901732?v=3","gravatar_id":"","url":"https://api.github.com/users/multiwebinc","html_url":"https://github.com/multiwebinc","followers_url":"https://api.github.com/users/multiwebinc/followers","following_url":"https://api.github.com/users/multiwebinc/following{/other_user}","gists_url":"https://api.github.com/users/multiwebinc/gists{/gist_id}","starred_url":"https://api.github.com/users/multiwebinc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/multiwebinc/subscriptions","organizations_url":"https://api.github.com/users/multiwebinc/orgs","repos_url":"https://api.github.com/users/multiwebinc/repos","events_url":"https://api.github.com/users/multiwebinc/events{/privacy}","received_events_url":"https://api.github.com/users/multiwebinc/received_events","type":"User","site_admin":false},"created_at":"2015-01-16T00:40:18Z","updated_at":"2015-01-16T00:40:18Z","body":"I'm sorry, but I have just been really busy. Unfortunately I was still able to reproduce it. Here's how, step by step:\r\n\r\n- (probably optional) Open up a new profile, or else delete the sync data, and then delete all the localStorage values. Just to start fresh and eliminate any sort of caching issues or whatnot.\r\n- (probably optional) Refresh for good measure\r\n- Add a master password and when sync is enabled, add a few accounts\r\n- Turn syncing off\r\n- Remove all of your accounts (except default, which cannot be removed)\r\n- Click on resources > Local Storage > chrome-extension://... > sync_profiles and change false to true\r\n- Refresh\r\n\r\nAll of the accounts I had deleted with sync off showed up again without entering a master password."}}