{"action":"opened","issue":{"url":"https://api.github.com/repos/brave/browser-laptop/issues/14586","repository_url":"https://api.github.com/repos/brave/browser-laptop","labels_url":"https://api.github.com/repos/brave/browser-laptop/issues/14586/labels{/name}","comments_url":"https://api.github.com/repos/brave/browser-laptop/issues/14586/comments","events_url":"https://api.github.com/repos/brave/browser-laptop/issues/14586/events","html_url":"https://github.com/brave/browser-laptop/issues/14586","id":336430147,"node_id":"MDU6SXNzdWUzMzY0MzAxNDc=","number":14586,"title":"Passwords are stored differently when Brave is installed via Snap vs. deb","user":{"login":"garrettr","id":407302,"node_id":"MDQ6VXNlcjQwNzMwMg==","avatar_url":"https://avatars1.githubusercontent.com/u/407302?v=4","gravatar_id":"","url":"https://api.github.com/users/garrettr","html_url":"https://github.com/garrettr","followers_url":"https://api.github.com/users/garrettr/followers","following_url":"https://api.github.com/users/garrettr/following{/other_user}","gists_url":"https://api.github.com/users/garrettr/gists{/gist_id}","starred_url":"https://api.github.com/users/garrettr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/garrettr/subscriptions","organizations_url":"https://api.github.com/users/garrettr/orgs","repos_url":"https://api.github.com/users/garrettr/repos","events_url":"https://api.github.com/users/garrettr/events{/privacy}","received_events_url":"https://api.github.com/users/garrettr/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-06-28T00:11:56Z","updated_at":"2018-06-28T00:11:56Z","closed_at":null,"author_association":"NONE","body":"### Description\r\n\r\nFollow-up from brave/brave-core#185.\r\n\r\nWhile working on the browser-laptop importer for brave-browser, I encountered some unexpected discrepancies between how browser-laptop stores certain types of user data, which seem to depend on whether it is installed via [Snapcraft](https://github.com/brave/browser-laptop/blob/master/docs/linuxInstall.md#snapcraft) or [deb package](https://github.com/brave/browser-laptop/blob/master/docs/linuxInstall.md#debian-jessie-stretch-and-ubuntu-artful-zesty-yakkety-xenial-and-trusty-amd64). I have noticed a specific discrepancy between how it stores passwords; other types of data may be affected as well.\r\n\r\nThis discrepancy is undesirable because it:\r\n\r\n- Creates additional complexity for brave-browser's `BraveImporter`\r\n- Has a low-to-moderate security impact (severity is debatable)\r\n\r\n### Steps to Reproduce\r\n\r\nYou will need a Linux installation that supports both the Snap and deb package installation methods. I am using Ubuntu 16.04.\r\n\r\n1. Follow the instructions in the documentation to install Brave via [Snapcraft](https://github.com/brave/browser-laptop/blob/master/docs/linuxInstall.md#snapcraft).\r\n2. Open Brave.\r\n3. Visit a website that has a password field to trigger the password save prompt (pretty much any login page will do—I'm using amazon.com). Log in. After logging in, Brave should present a \"Would you like Brave to remember the password?\" prompt. Click Allow.\r\n4. Quit Brave.\r\n5. Disable the Brave snap: `snap disable brave`. This prevents the Snap package from conflicting with the deb package we're about to install, but avoids deleting the user data directory, which we will want later for comparison.\r\n6. Follow the instructions in the documentation to install Brave via [deb package](https://github.com/brave/browser-laptop/blob/master/docs/linuxInstall.md#debian-jessie-stretch-and-ubuntu-artful-zesty-yakkety-xenial-and-trusty-amd64).\r\n7. Repeat steps 2-4 with the version of brave you just installed from the deb package. If you get the error `bash: /snap/bin/brave: No such file or directory`, try again in a new terminal.\r\n\r\n**Actual result:**\r\n\r\nNow we want to compare how each Brave stored passwords. Run the following commands in a terminal:\r\n\r\n```\r\n# deb package's user data directory\r\nsqlite3 ~/.config/brave/Login\\ Data \"select origin_url, username_value, password_value from logins;\"\r\n# Snap's user data directory\r\nsqlite3 ~/snap/brave/current/.config/brave/Login\\ Data \"select origin_url, username_value, password_value from logins;\"\r\n```\r\n\r\nNote that there are no results for the query when it is run on the deb package's `Login Data`. This is because browser-laptop/Muon/Chromium prefers to store saved passwords in the system keychain on Linux when possible (on Ubuntu, open `Passwords & Keys` and you should see an entry for the test login you saved).\r\n\r\nNote that there is a result for the query when it is run on the Snap package's `Login Data`; furthermore, note that `password_value` is saved in plaintext.\r\n\r\n**Expected result:**\r\n\r\nBrave should store passwords in a consistent manner regardless of the method that was used to install it. Some people may also feel it is important that they be stored encrypted on disk; I'm under the impression that this is a long-running point of contention in the security community. For comparison, Chromium defaults to storing sensitive data (cookies, passwords, etc.) encrypted on disk.\r\n\r\n**Reproduces how often:**\r\n\r\nConsistently.\r\n\r\n### Brave Version\r\n\r\n**about:brave info:**\r\n\r\n#### Snap brave\r\n\r\n```\r\nBrave: 0.22.721 \r\nV8: 6.6.346.32 \r\nrev: bfe7cdd026c68013236ebe206a33448db9370fca \r\nMuon: 6.0.12 \r\nOS Release: 4.13.0-45-generic \r\nUpdate Channel: Release \r\nOS Architecture: x64 \r\nOS Platform: Linux \r\nNode.js: 7.9.0 \r\nBrave Sync: v1.4.2 \r\nlibchromiumcontent: 66.0.3359.170\r\n```\r\n\r\n#### deb package Brave\r\n\r\n```\r\nBrave: 0.22.810 \r\nV8: 6.7.288.43 \r\nrev: 8f30eeba0c2d6cccf1920a360b4774f820adbc58 \r\nMuon: 7.0.6 \r\nOS Release: 4.13.0-45-generic \r\nUpdate Channel: Release \r\nOS Architecture: x64 \r\nOS Platform: Linux \r\nNode.js: 7.9.0 \r\nBrave Sync: v1.4.2 \r\nlibchromiumcontent: 67.0.3396.71\r\n```\r\n\r\n**Reproducible on current live release:**\r\n\r\nYes.\r\n\r\n### Additional Information\r\n\r\nFrom my investigation, I believe the cause of the discrepancy is Snap's containment. I noticed the following, likely relevant, log message from Snap brave only:\r\n\r\n```\r\nGkr-Message: secret service operation failed: An AppArmor policy prevents this sender from sending this message to this recipient; type=\"method_call\", sender=\":1.97\" (uid=1000 pid=5052 comm=\"/snap/brave/25/usr/bin/brave --no-sandbox \") interface=\"org.freedesktop.Secret.Service\" member=\"SearchItems\" error name=\"(unset)\" requested_reply=\"0\" destination=\"org.freedesktop.secrets\" (uid=1000 pid=1619 comm=\"/usr/bin/gnome-keyring-daemon --daemonize --login \")\r\n```\r\n\r\nMy guess is Snap's containment (which uses AppArmor on Ubuntu) is preventing Snap brave from accessing the GNOME keyring, so the Muon/Chromium code is falling back to using the basic (unencrypted) password store, as described in this [comment](https://cs.chromium.org/chromium/src/chrome/browser/password_manager/password_store_factory.cc?l=175-178&rcl=261b27df2fef8a0bcc00e63e6e85806ea3ac1b86)."}}
{"actor":{"display_login":"garrettr"}}