> Elliott Kember, a UK-based software developer from New Zealand who discovered the flaw

Oh, please! This has been discussed in various official Chrome support lists for years. I have brought it up here on HN multiple times. Here's one from a year and a half ago:

https://news.ycombinator.com/item?id=3654830

I was not, by any measure, the first to highlight this. The issue has been hotly debated on the chromium forum since at least 2008. Yes, FIVE years ago.

https://code.google.com/p/chromium/issues/detail?id=1397

The Guardian reveals utter ignorance by declaring that this fellow "discovered the flaw".

I felt compelled to post a comment on the Guardian. Here is is:

http://discussion.guardian.co.uk/comment-permalink/25827439

Before anyone goes for my throat, look, I realize that browsers need to have access to the unencrypted data in order to fill out forms. I get that. However, Google/Chrome ought to give me the choice to have to enter a master password every time that data is requested. In other words, the browser should not, independent of my input, have access to my encrypted data.

With this comes the possibility of perhaps allowing some passwords to be unencrypted. I make a distinction between a password for non critical sites (i.e.: posting comments on The Guardian) and financially or personally critical services such as bank accounts, various developer accounts, payroll services, etc. I could and should be able to tell the browser which non-critical logins could be stored without encryption and, therefore, available to the browser without my authorization. Everything else should be secure.

If they enabled a master password they'd probably deal with 75% to 99% of the cases where an average user's machine could be accessed by what I am going to call a hypothetical evil ten year old kid. If you loose your laptop or leave it behind at the coffee shop this can also be a good layer of protection for anyone but those intent on stealing your private information.

Locking your workstation isn't a solution. You can break into a Windows machine in a few minutes by using software that removes user passwords. Very easy. I have a disk with such software (legally purchased, not some obscure warez-site crap) for use when an employee leaves and forgets to unlock their workstation (or leaves it locked intentionally). Telling people that they ought to log out and have passwords on their user accounts is pointless. Getting past user logins is stupid-easy.

I am mostly talking about what I've come to refer to as the "Uncle Fester" user. A bit of humor there but not a pejorative at all. This includes my mother, uncle, local school teacher, cop, soccer coach. Anyone who is not tech savvy and has no clue whatsoever about what is going on and what the potential risks might be. They only know enough about computers to push the mouse around and use it and maybe a little bit above that. This, again, is not a pejorative. We can't expect or demand that the average computer user be a CS grad with a minor in security. That's just not reality.

On the assumption that my proposed user profile is on point, we, then, are responsible for guiding them towards safe usage. This means both informing as well as providing them with tools to help protect them. Taking a Silicon Valley CS-expert academic view of the world is not helpful to anyone. A simple master password would remove a huge layer of risk for most users. It's that simple.

And, of course, the browser is exactly where the user ought to be educated about the choices he or she has to make. You should not be able to store passwords casually without having to read a few single-sentence pages explaining the consequences of what you are about to do. I say a few single-sentence pages because if you fill a page with text people will treat it just like a TOS page and click through without reading any of it.

Here's one potential sequence. Each sentence is displayed in large print against a white background. The button used to advance from one screen to the next would have an activation delay of several seconds in order to prevent the user from rapidly clicking through these pages.

"Saving passwords in the browser can be risky"
buttons: "Tell me more", "Cancel"

"Anyone who gains access to your computer will
be able to see your logins and passwords."
buttons: "Tell me more", "Cancel"

"You can reduce the risk by setting a master password"
buttons: "Tell me more", "Cancel"

"If you use a master password you will need to enter it
every time the browser needs this data to fill out online forms."
buttons: "Tell me more", "Cancel"

"A master password is not entirely safe and will not stop
a tech-savvy person from gaining access to your information"
buttons: "Tell me more", "Cancel"

"You can also encrypt your login and password data"
buttons: "Tell me more", "Cancel"

"Encryption will stop the vast majority of potential data thiefs"
buttons: "Tell me more", "Cancel"

"Encrypted data can be accessed by tech-savvy thieves using
specialized tools. However this takes significant amount
of effort and time."
buttons: "Tell me more", "Cancel"

"You should understand that no method can provide an absolute
guarantee of preventing access to your private information.
Encrypting your data will limit access to anyone but the most
determined experts."
buttons: "Tell me more", "Cancel"

"If you encrypt your data you will need to enter a password
every time the browser needs this data to fill out online forms."
buttons: "Tell me more", "Cancel"

"How would you like to store your login and passwords?"
buttons: "Please encrypt my data"
"I only want a master password"
"I don't want any protection"
"I would like to learn more before making a decision"
"I don't want to store my passwords in the browser"

I'm sure this could be fine tuned and made interesting, slick and inviting for the user to read. I can even be done in animated or video form. The point is that, in contrast with what the Uncle Fester users is given today this approach would go a long way towards both educating and promoting safe practices.