What information is stored locally when signed in with Chrome?

Question

At work I signed into Google Chrome using my personal Gmail account. I thought I would be using the same computer the next day so I didn't log out. My team got moved to a completely different floor and our badges no longer work on the old floor. What information of mine is stored locally on the computer and is accessible without my password? I have 2 factor authentication enabled.

I red How to remotely log out from Google chrome? and one questions specifies logging out remotely doesn't "clear bookmarks, cookies, or saved passwords"

Is it possible for someone to still access my Google Calendar, Gmail or Google Drive? I do have some sensitive/personal things on them, but would like to avoid the embarrassment of explaining to management I want back to the computer I was on because I don't trust them and would like to log out of my personal account.

Just because I signed into Chrome with my Gmail, does it mean any one with access to Chrome can access my Gmail? The computers are running Windows 7.

TL;DR when signing out of Chrome remotely, what data is left behind on the local computer and is it encrypted?

Answer 1

There are 2 ways to interpret this question:

1. you signed in to the Chrome browser (likely), or
2. you signed in to the Gmail webapp

The last one is relatively harmless if you logged out remotely on time. No data will be left on the local machine except the default stuff mentioned below. In the worst case Chrome also saved your Google login password, but I don't think it ever actively prompts users to save Google credentials (you'd have to click the key icon and save it).

If you didn't log out they have access to all your Google services (Keep, Drive, Hangouts, Photos, etc). Luckily changing your Google password does require re-authentication.

Tip: if you save your passwords using Google Chrome, don't include your Google password. Add accounts.google.com to the "never save" list in the settings to be safe. You might also want to exclude your recovery email account password.

Logging in to Chrome (1) is like logging in to any other Google service (2). Except in addition it will sync files to the local user profile, and there is no 'clean' way to logout of the browser remotely. The moment you logged in you were prompted:

When you clicked OK it immediately started copying stuff from the cloud to your local machine. There is no way to login without sync set to "all". If you are quick you can change the settings before it pulls in everything (maybe pull out your ethernet cable the moment you login). It is poor design but I guess most people want to always sync everything.

The main danger is that your passwords may be compromised. The next person to access the Chrome browser will have the same options you had. The exact options/information the user has access to is determined by the sync settings. As a reminder, these include:

• Apps
• Autofill
• Bookmarks
• Extensions
• History
• Passwords
• Settings
• Themes & Wallpapers
• Open Tabs
• Credit cards and addresses using Google Payments

So if you save your passwords to the cloud, they are now likely on the local machine. If you saved your Google password they can also change the password to block you out (unless you have 2-Step & the device was not exempted). If you think your passwords are compromised you need to change them all one by one. Change your Google password first.

The remaining issue is how your data is accessible. It depends on if you logged out (remotely) or not. If you are not logged out yet, they can use the settings menu to view your passwords. If you managed to log out, they will have to browse to the profile folder on the harddrive and use an sql client.

For the password data, in both cases they will need the OS user account credentials (e.g. Windows login) because the file is encrypted by Chrome. Your other synced data isn't encrypted locally, so they can view e.g. your history file if they know what sql lite is.

Apart from your synced data, the default user profile saves a few other tidbits (regardless of whether you signed in or not):

• Some search engines are auto-added to a list. (unpreventable)
• Local search history. (unpreventable)
• Like most browsers it saves cookies by default. E.g. if you clicked "remember me" on your dropbox login, though dropbox lets you sign out remotely too.
• Google account names are saved. So the next person to sign in will see your account in a drop-down list. (unpreventable)

Use Guest profile or Incognito mode to avoid those default data saves, the 'unpreventable' items can be prevented at the OS level by changing file write access but that's off-topic. Otherwise, these data can only be scrubbed retroactively using local access.

Tip: Logging out of the browser remotely is messy and does not allow you to remove the saved data (e.g. passwords, login sessions) from the local machine. For exact options on how to log out see: here.

Also note that after you logged in, your cloud settings may have synced and overridden any local privacy settings you did prior (e.g. disable saving passwords, login & sync, oops save passwords is enabled again).

So 2SA will save you only if your Google password was compromised. It will prevent them from logging back in again after you remotely logged out, and from changing your password before you managed to remotely logout.

Is it possible for someone to still access my Google Calendar, Gmail or Google Drive?

Since you logged out permanently and these aren't related to sync, the answer is no. The web services don't store much locally as far as I know.