(Edit: said "yahoo to reissue passwords" instead of "email addresses" initially, because I'm a derp.)
-----
"I appreciate how this appears to a novice"
Respectfully, I don't think this is a valid answer. This is the same sort of "I know better than you because I'm in the industry" thing that has led Yahoo! to believe that it's okay to re-issue email addresses: "we've done a study that we won't show you, we decline to address your criticisms, and we're right. We wanted to talk to you in public to create the illusion of interactivity and contact, but in reality we're ignoring your statements, refusing to explain ourselves, and declining to adjust."
LinkedIn said literally exactly the same thing about their password strategy right before their plaintext password database got owned.
It turns out that working at Google and saying nuh-uh isn't actually a valid form of explaining the security choices you're making in a way that almost nobody else is aware of. Having worked at IBM Security and the CIA doesn't change that. Whereas you may call the people pointing out the obvious problems in your approach amateurs, your ability to actually interpret what they say seems to be very, very limited.
I would note that your own past employers agree. What you're doing is a violation of FIPS 140-3, which your former employers helped the NIST craft.
No other browser does this. There's a good reason that everyone else does something different.
.
"[we] have quite a bit of data to inform our position"
You have quite a bit of data to support that it is not a critical security defect to allow people to pull passwords out of a little known browser dialog?
I find this unlikely, on grounds that I can't even imagine what sort of data would be used to support this.
Am I correct in suspecting that you will absolutely refuse to explain this claim, yet still expect it to be taken seriously?
.
"what you're proposing is that that we make users less safe than they are today by providing them a false sense of security"
No, eliminating a hidden attack vector does not create a false sense of security: nobody will know. In the meantime, an extant vulnerability will go away. This is the exact opposite of correct, and honestly fairly transparently so.
.
"And while you're certainly well intentioned, what you're proposing is that that we make users less safe"
And while you're certainly well intentioned to suggest that a car should have seatbelts, what you're proposing is that we make users less safe by encouraging them to drive over fifteen miles an hour.
The disconnect between your theory of how people use browsers and how people actually use browsers, as the head of security, making choices like these, is genuinely alarming.
But you have data. Which, conveniently, nobody can see, or point out your misunderstandings within.
Because that's how science works, or something, probably.
.
"encouraging dangerous behavior."
Taking away a little known mechanism for people to extract saved passwords from the browser does not in any way encourage dangerous behavior.
.
"That's just not how we approach security on Chrome."
It appears that how you do approach security on Chrome is with transparently false anecdotal claims backed up by no measurements, unprovided claims of difficult to guess about data, and no willingness to look at other peoples' points of view.
In the whole of human security history, this has never gone well.
Unfortunately, you have the provenance, and in unweildly large security organizations, that's often quite a bit more highly valued than actually hearing what other people say.
It is absolutely fascinating that Google's browser's head of security thinks it's a good idea, backed by mystery data, to be able to pull saved passwords out.
Of curiosity, do you honestly expect to be taken seriously when you fly in the face of every best practiced, based on data you won't provide, while just calling other people amateurs?
You realize how this sounds, right? Like denial?
Good lord. "We make your passwords recoverable from a dialog you don't know about because if we didn't you'd be encouraged into unsafe behavior."
What unsafe behavior is that? Saving passwords?
Seriously, you're intentionally leaving it weak so that nobody will use it for important things, but then not actually making them aware of that?
Just take it out, then.
Mind-boggling.
Truly, these are the situations over which we abuse the phrase "stockholming."
-----
"I appreciate how this appears to a novice"
Respectfully, I don't think this is a valid answer. This is the same sort of "I know better than you because I'm in the industry" thing that has led Yahoo! to believe that it's okay to re-issue email addresses: "we've done a study that we won't show you, we decline to address your criticisms, and we're right. We wanted to talk to you in public to create the illusion of interactivity and contact, but in reality we're ignoring your statements, refusing to explain ourselves, and declining to adjust."
LinkedIn said literally exactly the same thing about their password strategy right before their plaintext password database got owned.
It turns out that working at Google and saying nuh-uh isn't actually a valid form of explaining the security choices you're making in a way that almost nobody else is aware of. Having worked at IBM Security and the CIA doesn't change that. Whereas you may call the people pointing out the obvious problems in your approach amateurs, your ability to actually interpret what they say seems to be very, very limited.
I would note that your own past employers agree. What you're doing is a violation of FIPS 140-3, which your former employers helped the NIST craft.
No other browser does this. There's a good reason that everyone else does something different.
.
"[we] have quite a bit of data to inform our position"
You have quite a bit of data to support that it is not a critical security defect to allow people to pull passwords out of a little known browser dialog?
I find this unlikely, on grounds that I can't even imagine what sort of data would be used to support this.
Am I correct in suspecting that you will absolutely refuse to explain this claim, yet still expect it to be taken seriously?
.
"what you're proposing is that that we make users less safe than they are today by providing them a false sense of security"
No, eliminating a hidden attack vector does not create a false sense of security: nobody will know. In the meantime, an extant vulnerability will go away. This is the exact opposite of correct, and honestly fairly transparently so.
.
"And while you're certainly well intentioned, what you're proposing is that that we make users less safe"
And while you're certainly well intentioned to suggest that a car should have seatbelts, what you're proposing is that we make users less safe by encouraging them to drive over fifteen miles an hour.
The disconnect between your theory of how people use browsers and how people actually use browsers, as the head of security, making choices like these, is genuinely alarming.
But you have data. Which, conveniently, nobody can see, or point out your misunderstandings within.
Because that's how science works, or something, probably.
.
"encouraging dangerous behavior."
Taking away a little known mechanism for people to extract saved passwords from the browser does not in any way encourage dangerous behavior.
.
"That's just not how we approach security on Chrome."
It appears that how you do approach security on Chrome is with transparently false anecdotal claims backed up by no measurements, unprovided claims of difficult to guess about data, and no willingness to look at other peoples' points of view.
In the whole of human security history, this has never gone well.
Unfortunately, you have the provenance, and in unweildly large security organizations, that's often quite a bit more highly valued than actually hearing what other people say.
It is absolutely fascinating that Google's browser's head of security thinks it's a good idea, backed by mystery data, to be able to pull saved passwords out.
Of curiosity, do you honestly expect to be taken seriously when you fly in the face of every best practiced, based on data you won't provide, while just calling other people amateurs?
You realize how this sounds, right? Like denial?
Good lord. "We make your passwords recoverable from a dialog you don't know about because if we didn't you'd be encouraged into unsafe behavior."
What unsafe behavior is that? Saving passwords?
Seriously, you're intentionally leaving it weak so that nobody will use it for important things, but then not actually making them aware of that?
Just take it out, then.
Mind-boggling.
Truly, these are the situations over which we abuse the phrase "stockholming."