Comment 8 for bug 1996267

I don't see how this debate is apropos. Whether or not the passwords are stored in the clear, or obscured with symmetric encryption using hard coded parameters in chrome is irrelevant. Both of these scenarios are entirely unacceptable.

That said, the answer here afaik is they're stored with a key generated with pbkdf2 using a password of "peantus" and a salt of "saltysalt" and 1 iteration. I think that because I know 100% this is how the Cookies work having examined the source in OSCrypt which is in os_crypt_linux.cc which I assume handles passwords too.

Ubuntu is the most popular Linux desktop. It's use is not unique from either OSX or Windows (which uses DPAPI). Both of which have entirely superior solutions to this problem and do not store passwords in clear text, or with hard-coded symmetric encryption. That's not the default anyway.

That all said, I will extend https://github.com/EvanCarroll/xbrowser/ to support decoding passwords soon.

So you'll have a tool you can run.. The command will be simple,

    xbrowser export chrome passwords

And you'll be able to dump all the passwords.