3 ms·
Browsers’ built-in password managers certainly have above average quality, at least when used as a purely local solution. A while ago I listed typical issues of
by palant 4y ago
Browsers’ built-in password managers certainly have above average quality, at least when used as a purely local solution. A while ago I listed typical issues of the browser integration in password managers, browser vendors have it all covered. Except for #5 where they opted for convenience: https://palant.info/2018/08/29/password-managers-please-make-sure-autofill-is-secure/ https://palant.info/2018/08/29/password-managers-please-make...
This doesn’t mean that they are perfect. While Firefox allows you to choose a master password for your local password storage, even after improvements this is a very weak protection: https://palant.info/2018/03/10/master-password-in-firefox-or-thunderbird-do-not-bother/ https://palant.info/2018/03/10/master-password-in-firefox-or.... From what I remember, Chrome doesn’t offer any local protection whatsoever – if somebody manages to copy this data off your computer it’s gone.
More critical aspect is the sync functionality: https://palant.info/2018/03/13/can-chrome-sync-or-firefox-sync-be-trusted-with-sensitive-data/ https://palant.info/2018/03/13/can-chrome-sync-or-firefox-sy.... Following my report, Chrome Sync has been improved and now offers reasonable protection at least for passwords – assuming that you set a passphrase which isn’t the default. In principle, Firefox Sync is better because it always encrypts all data, not merely passwords. But its bruteforce protection is very weak, the bug report I link to is still unresolved. So you would need a really strong password to protect the data (ideally randomly generated).