This is misleading. If you follow the links to the Chromium bug tracker, you'll note that Chrome integrates with the GNOME and KDE encrypted password managers when they're available. If they're not, it falls back to storing passwords itself with obfuscation, which is the best it can do. (On Windows and OS X, it uses CryptProtectData and the Keychain API, respectively.)<p><a href="https://code.google.com/p/chromium/wiki/LinuxPasswordStorage" rel="nofollow">https://code.google.com/p/chromium/wiki/LinuxPasswordStorage</a>
I guess a lot of others are also wondering, "What's the point?"<p>If an attacker can read the file the cookies are stored in, you have already lost.<p>It even mentions "obfuscation" - which might be a <i>slight</i> obstacle if this was closed-source - but Chromium is open-source.
Some more details from the source:<p>Password is: "peanuts"
Salt is: "saltysalt"
Algorithm used: AES-128-CBC
The number of KDF iterations is: 1<p>Edit: Indicate that no. of iterations is for the Key Derivation Function
"ksalt - at least salt is a variable, surely it at least is randomly generated, right?"<p>> // Salt for Symmetric key derivation.<p>> const char kSalt[] = "saltysalt";
I haven't looked at the caller code but are you sure that only the cookie code is using this function? The function looks pretty generic and it might be used somewhere else as well...