[archivator]

You could in theory salt the primary account password with a new salt, derive a key from it and use that to encrypt the password list (sending the salt alongside it). This of course implies that the plaintext password never hits Google's servers, which it probably does.

In general, I'm not sure this is a valid threat model. If you're not trusting Bob with your Wi-Fi passwords, why are you trusting him with everything else? If anyone compromises Google, there's far more valuable data on your account than the Wi-Fi list. Even if that's all they gain access to, it's pretty hard to exploit remotely. If someone is targeting you at this scale, you have bigger problems to worry about.

[HNaTTY]

Well I don't agree that there's far more valuable data than the ability to access my internal network. If my wifi network wasn't segregated from my wired network, by getting my wifi password you have bypassed my firewall, giving you access to my/my company's servers.

[archivator]

If someone has the resources to obtain your Wi-Fi password from Google and is determined enough to get within range of your network, you're being targeted by a very dedicated adversary. Things like physical security, TEMPEST and listening devices become valid concerns. This is a highly unlikely adversary for the majority of internet users.

Note that non-targeted attacks (the type that leak password lists) are not a serious threat here.

[kbenson]

That's not necessarily true. I imagine the data would most likely be targeted by a third party that's disinterested in you, but very interested in your adversary's money. I wonder what the going rate rate for all the WiFi passwords on my block would be. Or neighborhood. Or zip code.