4 ms·
Storing your master password anywhere is an obvious fuckup. The story here is that just by having a valid session you can export all passwords from google passw
by jiofih 6y ago
Storing your master password anywhere is an obvious fuckup. The story here is that just by having a valid session you can export all passwords from google password manager without it ever asking for authentication.
- gundmc 6y agoSmall correction - it asks for your device password (try it yourself if you use the chrome password manager). In this case something with NoMachine exposed/disabled the device password as well. Essentially the OP's configuration allowed an attacker unfettered access to the machine while a "blessed" chrome session was still active and had their master password stored in Safari.
- fasterthanlime 6y agoIf you view passwords in Google Chrome, it asks for the device password. If you view them from the online Google Passwords Manager website, it doesn't ask for the device password (how would it?).