https://bugs.chromium.org/p/chromium/issues/detail?id=1000799

Seems like we might need migrator updates to continue migrating things chromium is encrypting with oscrypt (the issue mentions cookies, though information elsewhere seems to indicate this may also affect passwords?).

I received an email about this telling me it affects Chrome 80 which is in Beta now:

tl;dr; you can no longer just call CryptUnprotectData on the password, but must retrieve the master key from the user's profile then unprotect the data in there, then use this as a key to decrypt each item using aead AES256. The code is all in components/os_crypt/os_crypt_win.cc

We really should telemetry that includes the Chrome version so we can potentially detect these issues before release.

[Tracking Requested - why for this release]: Can no longer import logins from Chrome/Edge/Chromium on Windows. This is now on their release channel.

Mardak, is this something you or your team can take since you are relying on it for your upcoming work?

(In reply to Matthew N. [:MattN] (PM me if request are blocking you) from comment #1)

must retrieve the master key from the user's profile then unprotect the data in there

Looks like we can get the key with something like…

await new OSCrypto().decryptData(
  atob(
    (await ChromeMigrationUtils.getLocalState()).os_crypt.encrypted_key
  ).slice("DPAPI".length)
);

then use this as a key to decrypt each item using aead AES256

But do we have something to aead.open/decrypt the ciphertext (after splitting out "v10" prefix and 12 bytes of nonce) with Aead::AES_256_GCM?

I see PushCrypto.jsm has something related from bug 1345665 maybe that could be called or copied? ??

Thanks for PushCrypto example usage of AES-GCM with crypto.subtle. I got chrome "master key" and password value decryption working!!

Sure! I wouldn't recommend calling into PushCrypto.jsm to decrypt passwords, as it is specific to Web Push encryption, but yes—Web Crypto supports AES-GCM, please feel free to crib from how we use it in push, as well as this Gist.

Ahaha, mid-air collision; glad you got it working, Madrak! 🎊

Ed, will we get a fix and an uplift request before the merge and the RC build on Monday?

I'm hoping to land this today after review and request uplift (before verify on nightly?) although this is my first time touching this code and long time since I've worked with crypto stuff. If MattN is busy, maybe jaws and/or Gijs can help review toolkit/components/passwordmgr and browser/components/migration?

QA steps:

1. from windows chrome 80, save a password, e.g., submit dummy username and password to bugzilla and save the login
2. open migration wizard from firefox, e.g., about:logins top-right "…" menu -> Import
3. complete wizard selecting Chrome and Saved passwords
4. make sure username and password imported for the site, e.g., from about:logins or going to the page and seeing login autocomplete

Here's some try builds for early testing before this gets to mozilla-central for verification:
https://treeherder.mozilla.org/#/jobs?repo=try&revision=93fb15beb91149f9c243d2847d55d89c548499e5
win: https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/EcVbeT8hToaXK4Hu3G4R-A/runs/0/artifacts/public/build/target.zip
mac: https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/QO1xEexVTfSJ0xwAoedtjQ/runs/0/artifacts/public/build/target.dmg

Backed out changeset 5e048feda16f (Bug 1613337) mac and linux opt all_files_referenced failures

Push with failures: https://treeherder.mozilla.org/#/jobs?repo=autoland&resultStatus=testfailed%2Cbusted%2Cexception&classifiedState=unclassified&revision=5e048feda16fa813208a1faec89eaed08c64cb2a

Failure log: https://treeherder.mozilla.org/logviewer.html#/jobs?job_id=291123436&repo=autoland&lineNumber=3366

Backout log: https://treeherder.mozilla.org/#/jobs?repo=autoland&resultStatus=testfailed%2Cbusted%2Cexception&classifiedState=unclassified&revision=27c3a7e3cb5120f9866feaf602e971371f17bad5

[task 2020-02-29T18:09:23.487Z] 18:09:23     INFO - indirectly whitelisted file: chrome://fxr/content/assets/icon-toggle-on.png used from chrome://fxr/content/prefs.css
[task 2020-02-29T18:09:23.487Z] 18:09:23     INFO - indirectly whitelisted file: chrome://fxr/content/assets/icon-logo-settings-preview.png used from chrome://fxr/content/prefs.html
[task 2020-02-29T18:09:23.487Z] 18:09:23     INFO - indirectly whitelisted file: chrome://fxr/content/assets/icon-reportissue.svg used from chrome://fxr/content/prefs.html
[task 2020-02-29T18:09:23.487Z] 18:09:23     INFO - indirectly whitelisted file: chrome://fxr/content/prefs.js used from chrome://fxr/content/prefs.html
[task 2020-02-29T18:09:23.487Z] 18:09:23     INFO - Buffered messages finished
[task 2020-02-29T18:09:23.487Z] 18:09:23     INFO - TEST-UNEXPECTED-FAIL | browser/base/content/test/static/browser_all_files_referenced.js | there should be no unreferenced files - Got 1, expected 0
[task 2020-02-29T18:09:23.488Z] 18:09:23     INFO - Stack trace:
[task 2020-02-29T18:09:23.488Z] 18:09:23     INFO - chrome://mochikit/content/browser-test.js:test_is:1320
[task 2020-02-29T18:09:23.488Z] 18:09:23     INFO - chrome://mochitests/content/browser/browser/base/content/test/static/browser_all_files_referenced.js:checkAllTheFiles:954
[task 2020-02-29T18:09:23.488Z] 18:09:23     INFO - chrome://mochikit/content/browser-test.js:Tester_execTest/<:1062
[task 2020-02-29T18:09:23.488Z] 18:09:23     INFO - chrome://mochikit/content/browser-test.js:Tester_execTest:1097
[task 2020-02-29T18:09:23.488Z] 18:09:23     INFO - chrome://mochikit/content/browser-test.js:nextTest/<:925
[task 2020-02-29T18:09:23.488Z] 18:09:23     INFO - chrome://mochikit/content/tests/SimpleTest/SimpleTest.js:SimpleTest.waitForFocus/waitForFocusInner/focusedOrLoaded/<:914
[task 2020-02-29T18:09:23.488Z] 18:09:23     INFO - Not taking screenshot here: see the one that was previously logged
[task 2020-02-29T18:09:23.488Z] 18:09:23     INFO - TEST-UNEXPECTED-FAIL | browser/base/content/test/static/browser_all_files_referenced.js | unreferenced file: resource://gre/modules/OSCrypto.jsm - 
[task 2020-02-29T18:09:23.488Z] 18:09:23     INFO - Stack trace:
[task 2020-02-29T18:09:23.489Z] 18:09:23     INFO - chrome://mochikit/content/browser-test.js:test_ok:1292
[task 2020-02-29T18:09:23.489Z] 18:09:23     INFO - chrome://mochitests/content/browser/browser/base/content/test/static/browser_all_files_referenced.js:checkAllTheFiles:958
[task 2020-02-29T18:09:23.489Z] 18:09:23     INFO - chrome://mochikit/content/browser-test.js:Tester_execTest/<:1062
[task 2020-02-29T18:09:23.489Z] 18:09:23     INFO - chrome://mochikit/content/browser-test.js:Tester_execTest:1097
[task 2020-02-29T18:09:23.489Z] 18:09:23     INFO - chrome://mochikit/content/browser-test.js:nextTest/<:925
[task 2020-02-29T18:09:23.489Z] 18:09:23     INFO - chrome://mochikit/content/tests/SimpleTest/SimpleTest.js:SimpleTest.waitForFocus/waitForFocusInner/focusedOrLoaded/<:914
[task 2020-02-29T18:09:23.489Z] 18:09:23     INFO - ignored unused whitelist entry: resource://app/blocklist.xml
[task 2020-02-29T18:09:23.489Z] 18:09:23     INFO - ignored unused whitelist entry: resource://gre/gmp-clearkey/0.1/manifest.json
[task 2020-02-29T18:09:23.489Z] 18:09:23     INFO - ignored unused whitelist entry: resource://gre/res/test.properties
[task 2020-02-29T18:09:23.489Z] 18:09:23     INFO - missing file: resource://gre/components/nsAsyncShutdown.js
[task 2020-02-29T18:09:23.490Z] 18:09:23     INFO - missing file: resource://gre/modules/commonjs/toolkit/loader.js
[task 2020-02-29T18:09:23.490Z] 18:09:23     INFO - missing file: resource://search-extensions/yandex/__MSG_extensionIcon__
[task 2020-02-29T18:09:23.490Z] 18:09:23     INFO - missing file: resource://services-sync/)%20==%200)%20%7B referenced from resource://services-sync/addonutils.js
[task 2020-02-29T18:09:23.490Z] 18:09:23     INFO - missing file: resource://app/localization/en-US/toolkit/global/textActions.ftl referenced from chrome://global/content/editMenuOverlay.js,chrome://global/content/elements/textbox.js,chrome://mozapps/content/update/updateElevation.xhtml,resource://devtools/client/framework/toolbox-context-menu.js,chrome://devtools/content/webconsole/index.html,chrome://browser/content/downloads/contentAreaDownloadsView.xhtml,chrome://browser/content/aboutDialog.xhtml,chrome://devtools/content/styleeditor/index.xhtml,chrome://browser/content/hiddenWindowMac.xhtml,chrome://browser/content/pageinfo/pageInfo.xhtml,chrome://browser/content/places/historySidebar.xhtml,chrome://browser/content/webext-panels.xhtml,chrome://browser/content/setDesktopBackground.xhtml,chrome://browser/content/browser.xhtml,chrome://browser/content/places/bookmarksSidebar.xhtml,chrome://browser/content/places/places.xhtml
[task 2020-02-29T18:09:23.490Z] 18:09:23     INFO - missing file: resource://gre/modules/worker/myModule.js referenced from resource://gre/modules/workers/require.js
[task 2020-02-29T18:09:23.490Z] 18:09:23     INFO - missing file: resource://gre/modules/workers/SimpleTest.js referenced from resource://gre/modules/workers/require.js
[task 2020-02-29T18:09:23.491Z] 18:09:23     INFO - missing file: resource://gre/modules/workers/Logger.js referenced from resource://gre/modules/workers/require.js
[task 2020-02-29T18:09:23.491Z] 18:09:23     INFO - missing file: chrome://geckoview/content/geckoview.xhtml referenced from chrome://global/content/customElements.js
[task 2020-02-29T18:09:23.496Z] 18:09:23     INFO - missing file: resource://app/localization/en-US/toolkit/printing/printPreview.ftl referenced from chrome://global/content/printPreviewToolbar.js
[task 2020-02-29T18:09:23.496Z] 18:09:23     INFO - missing file: resource://gre/localization/en-US/abuseReports.ftl referenced from chrome://mozapps/content/extensions/abuse-report-panel.js
[task 2020-02-29T18:09:23.496Z] 18:09:23     INFO - missing file: resource://app/localization/en-US/abuseReports.ftl referenced from chrome://mozapps/content/extensions/abuse-report-panel.js
[task 2020-02-29T18:09:23.496Z] 18:09:23     INFO - missing file: resource://app/localization/en-US/toolkit/main-window/findbar.ftl referenced from chrome://global/content/elements/findbar.js
[task 2020-02-29T18:09:23.496Z] 18:09:23     INFO - missing file: resource://gre/modules/Snackbars.jsm referenced from chrome://global/content/aboutSupport.js
[task 2020-02-29T18:09:23.497Z] 18:09:23     INFO - missing file: chrome://gfxsanity/content/sanityparent.html referenced from resource://gre/components/marionette.js

https://hg.mozilla.org/mozilla-central/rev/6814ecabf7d9

To test with Chromium 79 that still uses the previous password format, use this zip:
https://www.googleapis.com/download/storage/v1/b/chromium-browser-snapshots/o/Win_x64%2F706915%2Fchrome-win.zip?generation=1571327342065686&alt=media

I got that file from https://commondatastorage.googleapis.com/chromium-browser-snapshots/index.html?prefix=Win_x64/706915/

Which I used https://omahaproxy.appspot.com/ to "Lookup" "79.0.3945.123" resulting in "Branch Base Position: 706915"

QA steps in addition to comment 11, saving a password from Chrome 80, same steps but save a login from Chromium 79.

Latest nightly 20200301094802 has the fix while the previous 20200229214828 doesn't have it.

20200229214828 + Chromium 79: login successfully imports
20200229214828 + Chrome 80: login fails import
20200301094802 + Chromium 79: login (still) successfully imports
20200301094802 + Chrome 80: login (now) successfully imports

Comment on attachment 9129701 [details]
Bug 1613337 - Support importing Windows Chrome/Edge logins with v10 AEAD format r?MattN!

Beta/Release Uplift Approval Request

• User impact if declined: Passwords silently fail to import from current Chrome Release (80)
• Is this code covered by automated tests?: Yes
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: Yes
• If yes, steps to reproduce: Comment 11 and comment 16
• List of other uplifts needed: None
• Risk to taking this patch: Medium
• Why is the change risky/not risky? (and alternatives if risky): Somewhat risky as this involves crypto related code changes to support both the old and new Chrome encryption versions, but impact should be limited to those using the Migration wizard on windows, which otherwise wouldn't work correctly without this fix.
• String changes made/needed: none

Comment on attachment 9129701 [details]
Bug 1613337 - Support importing Windows Chrome/Edge logins with v10 AEAD format r?MattN!

P1 and we know the feature is broken now, so uplift approved for the beta branch before the merge.

Hello,

Confirming this as verified fixed with 75.0a1(ID: 20200301213924) . Importing passwords is done without any issues using Windows 10x64 and macOS 10.15 from both Chromium 79 and Chrome 80. Imported data is present in about:logins or going to the page and seeing login autocomplete.

https://hg.mozilla.org/releases/mozilla-beta/rev/5bcc0edc4ecc

Confirming this as verified fixed with 74.0(ID: 20200301213924) . Importing passwords is done without any issues using Windows 10x64 and macOS 10.15 from both Chromium 79 and Chrome 80. Imported data is present in about:logins or going to the page and seeing login autocomplete.