Vanadium: Are My Password Credentials Being Exposed via Google Password Manager?

sienks

I'm trying to sign into an app, to do this the app loads a webview and uses their websites sign-in portal to authenticate.

I use Vanadium as my default browser (therefore the app is using Vanadium to login).
I use ProtonPass as my password manager

I have the following settings:

Settings > Passwords, passkeys & autofill

Preferred service: ProtonPass
Additional services: Google (which is turned off)

Vanadium settings > Autofill Options: Use other providers

The autofill feature in Vanadium works as expected and I am able to login using the credential stored in ProtonPass.
However the prompt references Google Password Manager and not ProtonPass, as follows:
screenshot

My question's are:

Are my ProtonPass credentials being exposed to Google Password Manager or any google related service ?
Why is it using / reference Google Password Manager?

fid02

sienks However the prompt references Google Password Manager and not ProtonPass, as follows:
screenshot

Indeed, that is part of Android's inferior FIDO UI. It doesn't mean that it's actually using Google Password Manager.

sienks Are my ProtonPass credentials being exposed to Google Password Manager or any google related service ?

There are no known privacy leaks in this regard. Why do you think Play Services would be stealing sensitive credentials? That's something malware would do. This is simply a UI quirk.

sienks Why is it using / reference Google Password Manager?

It's Google's design that is causing this UI confusion. No one but Google can conclusively answer as to why they are plastering the name of their password service on this screen. I don't blame you for feeling confused.

sienks

fid02 I see, that makes sense. Thanks for taking the time to reply.

p338k

fid02 Indeed, that is part of Android's inferior FIDO UI. It doesn't mean that it's actually using Google Password Manager.

Isn't it Chromium that hard coded to use Google Password Manager? I have heard of a browser that uses its own implementation, but it is no longer maintained.

fid02 There are no known privacy leaks in this regard. Why do you think Play Services would be stealing sensitive credentials? That's something malware would do. This is simply a UI quirk.

I am also not aware of any specific leaks and think that leaking the private key would be a sign if bad design. I could see Google using public components of the credentials and login times for advertising purposes, but I have no direct evidence that Google does collect that information.