Ask HN: Prompted to turn on “Enhanced Safe Browsing” checks passwords for breach
Once of the the "benefits" of this is that it would let me know if the credentials I use to log into some website have been exposed in a data breach.
That's all well and good (I guess?) if it's sending hashed versions of those passwords to Google, but according to https://support.google.com/chrome/answer/10311524?hl=en#zippy=%2Chow-password-protection-works
> Chrome can warn you if the username and password you use to sign in to a website were involved in a data breach. This setting is turned on by default.
> ...
> To check your credentials, Chrome first encrypts your username and password. Then it sends the encrypted credentials to Google for comparison against an encrypted list of known breached data. If Chrome detects a match between the encrypted sets of data, it displays a warning that prompts you to change your password. Google never learns your usernames or passwords during this process.
I'm curious how Google is comparing "encrypted" passwords against known breaches, in a secure way. I'm fine sending hashes or, even better, encrypted hashes. But if it's sending the password (or even encrypted password that Google is able to decrypt), that's a pretty strong no from me.