I’d love it if google did this to me. I wouldn’t settle for anything less than a 9 figure payout.

Bear in mind, you would probably not see this as a covert/criminal act, but something sold as a feature. "Our artificial intelligence now can assist you by analyzing your transaction habits with your bank and can help manage your Facebook account."

The sort of thing as a tech crowd would horrify many of us, but the public would largely go "oh neato".

It's 2FA so it would only get them half way there right?

> In many cases they are already syncing a copy of your passwords.

No, that gets them the full way there. They have your 2FA codes, and if you use Chrome and opt into it syncing passwords for you (passwords.google.com), this gives them both pieces of the puzzle.

If you use chrome, they could just download your cookies if they really wanted to.

Chrome passwords are encrypted with your password (just not e2ee) so it'd have to be a targeted attack where they log your password the next time you log in and then use that to decrypt your chrome passwords. Chrome also allows you to set your own sync passphrase different from your Google account password.

Google says it's encrypted "with your Google account", not with your password. I don't know what the former means, but they do not say they're using your password to encrypt it.

I hope someone has set up a honeypot by backing up a load of secrets with this service, and then seeing if anyone ever uses any of those secrets.