I want to be able to protect my Chrome user profile with a password so I don't have to constantly login/out of all sites to maintain privacy on a shared PC.
I enabled the flag Enable new profile management system in Chrome 42.0.2311.135 (64-bit) on OSX. It seems to do nothing in terms of a profile lock. I've read guides like this howtogeek article but there doesn't seem to be any padlock icon available for Mac.
Does the feature work with my setup? Is there a good substitute if not?
41 Answer
TL;TR:
The padlock part of that preview feature was removed, and will likely never exist in Chrome. It would always be a false security and only expose Google and Chrome users to potential embarrassment.
Details
The "new profile management system" is live and is enabled by default as of v44 (~ Jan 11, 2015).
However, the padlock function that was in "preview" versions of that feature got removed before the feature went live. People have asked for this since 2008, and Google has said since at least 2010 that such a "lock" gives users a false sense of security, and they have stated many times since, that they will not ever add a profile lock feature like this to Chrome.
It is true that it would be false security. A profile lock could be easily defeated by a nosey girlfriend or co-worker with access to your logged on computer, and tools that they could download. They could easily install a keylogger, or a use a tool to read all the passwords out of the OS's vault!
Many people think they are in a situation where they trust the other users of a family computer sufficiently that a simple password would keep the casual snoop out. Google in it's wisdom is telling you that if you value your privacy, you can't share your PC with people that you can't trust not to snoop.
What Google is trying to avoid:
Here are some of the clickbait headlines you would see about two weeks after google puts a feature like this into Chrome:
- "10-year-old releases "hack tool" to retrieve passwords from Google Chrome!!!"
- "New trick lets girlfriends see his porn in Google Chrome's history."
- "Security breach in Google Chrome give access to all passwords."
The press wouldn't care that the actual "flaws" exploited were in the thinking of numbskull that allowed his GF to to install a keylogger or run a tool on his PC that retrieves passwords out of a logged-in OS session like any app already can!
Bloggers and even the "respected" tech media would have a hay-day with any such "breach", even though no flaws actually existed in Google's software or in the OS, only in user's behavior and expectations.
Because Chrome has zero locking, any such stories are instead greeted with:
- "Duh, you just open chrome and click-click-click you see the passwords (or the porn history)"
- "This isn't news! He should have seen that coming when he gave is GF his windows account password."
Since the profile is not locked, the implications of OS account access are made obvious to everyone.
Cop-out?
People could view it as a cop-out by google. Because they don't offer to secure it, there is no way that they can take any flack related to chrome privacy when users are careless with their local device security.
Reality
Chrome designers are just accepting the reality we live in, and encouraging users to do the same. Physical access is the end-game ("check" if not "mate") in computer security. All bets are off if someone has your hardware.
People still think they want a browser lock feature, and it keeps coming up in discussions, but it unlikely to ever happen in chrome. What is surprising is that it made it six months as a public "preview" feature that could be enabled with a flag. Somebody snuck that past the smart people higher-up.
Firefox has such a feature. But again, before you switch over, please realize that you are better off letting your OS do it's best to protect your secrets by locking your PC when you are away, and not letting un-trusted people touch your PC.
#enable-new-profile-management is dead. Chrome's "profile-lock" won't be back. Accept reality, move along.
