3 ms·

This is the main problem with Chrome for me at the moment. How hard can it be to add a master password prompt before showing the passwords? Or even to only stor

This is the main problem with Chrome for me at the moment. How hard can it be to add a master password prompt before showing the passwords? Or even to only store them encrypted? I know they wouldn't really be safe even if encrypted, but I just want them not to be available to any random person that has access to my computer for 3 minutes...

itp 14y ago
Not intended to excuse Chrome here in any way, but I've had no problem using KeePass for my passwords. I use a Chrome extension to let KeePass entries auto-populate in the browser, and my database locks itself after only a few minutes of inactivity (or I can explicitly lock it).
michh 14y ago
A random person with access to your computer could easily install a keylogger in those 3 minutes.
- runarb 14y ago
  True, but that requires much more technical know-how. For one you need to have a keylogger available when the victim is away from the computer. The keylogger may also be detected by a virus killer, now or it he further. The key logger most also send the passwords somewhere, leaving a forensic trace (or the culprit must get access to the computer again to retrieve the passwords). The chrome "hack" on the other hand can easily be done if you have the opportunity and require no technical know-how or preparations. It also leaves no trace.
PeterisP 14y ago
If you want to store them encrypted, then chrome has to ask your master password every time you want to actually use the stored passwords (i.e., open a random website). If you don't store them encrypted - then your passwords (as well as everythin else) are available to any random person who has access to your computer for 3 minutes, and not showing them directly is just a minor inconvenience. Actually, the solution is simple - don't have random persons access your computer for 3 minutes; always locking your screen when leaving is the simple and effective way to counter this risk and many others.

itp 14y ago

Not intended to excuse Chrome here in any way, but I've had no problem using KeePass for my passwords. I use a Chrome extension to let KeePass entries auto-populate in the browser, and my database locks itself after only a few minutes of inactivity (or I can explicitly lock it).

michh 14y ago

A random person with access to your computer could easily install a keylogger in those 3 minutes.

runarb 14y ago
True, but that requires much more technical know-how. For one you need to have a keylogger available when the victim is away from the computer. The keylogger may also be detected by a virus killer, now or it he further. The key logger most also send the passwords somewhere, leaving a forensic trace (or the culprit must get access to the computer again to retrieve the passwords). The chrome "hack" on the other hand can easily be done if you have the opportunity and require no technical know-how or preparations. It also leaves no trace.

PeterisP 14y ago

If you want to store them encrypted, then chrome has to ask your master password every time you want to actually use the stored passwords (i.e., open a random website). If you don't store them encrypted - then your passwords (as well as everythin else) are available to any random person who has access to your computer for 3 minutes, and not showing them directly is just a minor inconvenience. Actually, the solution is simple - don't have random persons access your computer for 3 minutes; always locking your screen when leaving is the simple and effective way to counter this risk and many others.