Hey, Fletcher:
Not sure of the initial conditions and if it can be reproduced. Which OS? Tablet, phone or PC? I also use Chrome, across Windows, Chromebooks, Android and Linux, and Google knows who I am and syncs bookmarks, history and a disturbing amount more across the platforms. I don't store passwords in the Chrome browser because all the browser data stores are less secure. I happen to use LastPass but there may be better solutions.
It seems that once you have logged into Chrome using a gmail account, Google feels free (okay, you probably clicked an 'OK' somewhere along the line) to store lots of info about Chrome, like a roaming profile, in the gmail account, and access it even if you are "logged out." and Google restores that state when it feels like it.
So, if you decide to use Chrome on a public computer (I advise against!) or someone elses's computer, I'd strongly recommend you log in using a guest (OS) account, and when you're done go to Settings, Advanced, Privacy and security, Clear browsing history, Advanced again and select all. Don't use the "Reset and clean up" options at the very bottom, because they're intended to fix a wonky browser without losing the history.
Two-factor authentication, Privacy Badger, HTTPS Everywhere, and ad blocking are pretty much my minimal settings these days.
On Mon, Jan 14, 2019 at 7:28 PM Fletcher Johnson FletcherSJohnson@yahoo.com wrote:
Hi all,
I use Chrome. I have a number of passwords saved. But I think I found a security issue and was wondering if anyone wanted to see if they had the same result (or already knows about it.)
Today, I was messing around with Chrome. I clicked on log out and then use another account. I created a new one using a non gmail account. When it came up, I still had all the same bookmarks, etc. So I went into settings and chose reset (advanced, at the bottom) as well as changed the default startup to be a new page. I then closed Chrome and rebooted the computer.
I start Chrome, and log in using the new email ID, I still see all the previous bookmarks. And if I go to settings, passwords, I can see all the passwords for all the sites that belonged to my real Gmail account. But I am logged in using the new email ID account.
The funny thing is if I go to settings/passwords, I can see all the passwords. But if I click on the option to view and manager saved passwords in your Google Account - on that web page, it says I have none... Very strange.
And yes, the passwords are *'ed out, but if you click on the eye icon and enter the windows login password, you can then see them as pure text.
Just curious to see if anyone else can replicate it.
Fletcher
Fletcher Johnson
mailto:FletcherSJohnson@Yahoo.com FletcherSJohnson@Yahoo.com
http://linkedin.com/in/FletcherJohnson LinkedIn.com/in/FletcherJohnson
twitter.com/fletcherJ
https://www.strava.com/athletes/fletcherjohnson strava.com/athletes/fletcherjohnson
408-946-0960 - work
408-781-2345 - cell
--- StripMime Report -- processed MIME parts --- multipart/alternative text/plain (text body -- kept) text/html
[excessive quoting removed by server]