documentation_complete: true

title: 'Disable Use of Cleartext Passwords'

description: "Chromium allows users to import and store passwords in cleartext. This should be \ndisabled by setting <tt>PasswordManagerAllowShowPasswords</tt> to <tt>false</tt>\nin the Chromium policy file."

rationale: 'Cleartext passwords would allow another individual to see password via shoulder surfing.'

severity: unknown

identifiers:
    cce: ""

references:
    disa: ""
    nist: ""
    stigid: DTBC0010

ocil_clause: 'use of cleartext passwords are not disabled'

ocil: |-
    To verify that the use of cleartext passwords is disabled, run the following command:
    <pre>$ grep PasswordManagerAllowShowPasswords /etc/chromium/policies/managed/*.json</pre>
    The output should contain:
    <pre>"PasswordManagerAllowShowPasswords": false,</pre>
