4 ms·

What's wrong with Chrome's built-in password manager nowadays?

by lima 10y ago

beambot 10y ago
Anyone with access to your computer can look at the plaintext passwords in Chrome just by going to settings > passwords > show. It's been a long-standing dispute... Chrome says "if people have physical access, security is broken anyway." But that's because they refuse to acknowledge the lesser threat model; "A non-tech savvy friend or family member borrowing my computer for 20 min" -or- "my computer gets stolen from my desk while I was logged in... and now they have access to all chrome passwords in plaintext." It's infuriating. Wish they'd fix that, even if it's a superficial fix.
- holtalanm 10y ago
  Not on windows. On windows is requires your windows password to unlock your passwords. Actually, I think it does that on Mac OS too. Don't know about Linux, since I haven't tried it.
  - drdaeman 10y ago
    It has support for Gnome Keyring or KWallet (IIRC, default is `--password-store=detect`). If you're using either, then it's the same.
    - lima 10y ago
      Yes, it's using the gnome-keyring which requires unlocking. How is this less secure than using LastPass or KeePass?
  - compuguy 10y ago
    Hasn't this changed in recent versions with the move to google smart lock?
jdc0589 10y ago
It has a much smaller feature set than any of the full fledged password managers.
- lima 10y ago
  But no additional attack surface either.
  - jdc0589 10y ago
    yes and no. There's malware out there that can get credentials from browser password stores. So, I agree that an external password manager introduces an additional attack surface, but it partially removes one as well.
rocqua 10y ago
The advantages of using a password manager - Password generation - Safe from google - Safety when google account is compromised (and physical access) - Non-password encryption When using a non-cloud solution (e.g. KeePass, local 1password installation) - Auditable and specified ecryption: I know how my passwords are encryped. I can check this by actually decrypting and finding my passwords - No automatic updates. You can't force an update to my client that breaks security.

What's wrong with Chrome's built-in password manager nowadays?

by lima 10y ago

What's wrong with Chrome's built-in password manager nowadays?

Anyone with access to your computer can look at the plaintext passwords in Chrome just by going to settings > passwords > show. It's been a long-standing dispute... Chrome says "if people have physical access, security is broken anyway." But that's because they refuse to acknowledge the lesser threat model; "A non-tech savvy friend or family member borrowing my computer for 20 min" -or- "my computer gets stolen from my desk while I was logged in... and now they have access to all chrome passwords in plaintext." It's infuriating. Wish they'd fix that, even if it's a superficial fix.

holtalanm 10y ago
Not on windows. On windows is requires your windows password to unlock your passwords. Actually, I think it does that on Mac OS too. Don't know about Linux, since I haven't tried it.
- drdaeman 10y ago
  It has support for Gnome Keyring or KWallet (IIRC, default is `--password-store=detect`). If you're using either, then it's the same.
  - lima 10y ago
    Yes, it's using the gnome-keyring which requires unlocking. How is this less secure than using LastPass or KeePass?
- compuguy 10y ago
  Hasn't this changed in recent versions with the move to google smart lock?

jdc0589 10y ago

It has a much smaller feature set than any of the full fledged password managers.

lima 10y ago
But no additional attack surface either.
- jdc0589 10y ago
  yes and no. There's malware out there that can get credentials from browser password stores. So, I agree that an external password manager introduces an additional attack surface, but it partially removes one as well.

rocqua 10y ago

The advantages of using a password manager - Password generation - Safe from google - Safety when google account is compromised (and physical access) - Non-password encryption When using a non-cloud solution (e.g. KeePass, local 1password installation) - Auditable and specified ecryption: I know how my passwords are encryped. I can check this by actually decrypting and finding my passwords - No automatic updates. You can't force an update to my client that breaks security.