Do you save passwords in Chrome? Maybe you should reconsider

[ShyWriter]

.
Do you save passwords in Chrome? Maybe you should reconsider

Summary: Every modern browser lets you save and sync user names and passwords for your favorite websites. Maybe that's not such a good idea.

By Ed Bott for The Ed Bott Report
August 7, 2013 -- 00:17 GMT (17:17 PDT)

You might want to think twice before you let someone borrow your computer.

The most obvious risk of allowing someone else access to your desktop is that they can impersonate you, using any app where you’re already signed in. They could send prank messages using your default email client, or profess your undying love for Justin Bieber using your logged-in Twitter account.

That’s annoying, but far from fatal.

But the situation becomes considerably worse if you use Google Chrome to save and sync passwords for easy logins at your favorite websites. An intruder who has unrestricted access to your computer for even a minute can view and copy all of your saved passwords just by visiting an easy-to-remember settings page: chrome://settings/passwords.

That link opens the local copy of your saved password cache, which is synchronized to every machine where you sign in with your Google account.

And the funny thing is, anyone who visits that page can see the plaintext version of every saved password just by clicking a button.

 

The saved password list shows the web address, username, and password for each saved set of credentials. Initially, the saved password is displayed as a row of asterisks. But if you click the masked password, you see a “Show” button that you can click to immediately display the saved password.



A malicious or spiteful intruder who can lure you away from your computer briefly can see your saved passwords, then close the settings page. And you have no idea that your credentials have been compromised.

Here’s what the attacker sees. I’ve altered the passwords and blurred crucial details in this screenshot, but it should give you a good idea of the scope of the problem:



This isn’t a new feature, of course, but the issue got some publicity earlier today when software designer Elliott Kember posted a rant titled “Chrome’s insane password security strategy” at his blog. And the issue got more heated when the post sparked a discussion on Hacker News where Chrome developer Justin Schuh told Kember, in essence, That’s not a bug, it’s a feature: (More...)
 
Continued at: http://www.zdnet.com/do-you-save-passwords-in-chrome-maybe-you-should-reconsider-7000019074/
 
Steve

[fivealive]

Firefox is the same way, it can come in handy, but that area should have a password on it that's needed to access it.

[AdvancedSetup]

Yes, annoying but much safer to always type in the password or at most only cache login via cookie and not locally stored password.

[ShyWriter]

Firefox is the same way, it can come in handy, but that area should have a password on it that's needed to access it.

 

I use the SECURE LOGIN Firefox extension which stores the passwords elsewhere.. (Similar to Opera's "Wand" extension.)

 

RE: https://addons.mozilla.org/en-US/firefox/addon/secure-login/?src=userprofile

 

EDIT: Oopss.. Initial link was the direct install; this link is to the Explanation page.. mea culpa; sorry...

Edited August 7, 2013 by ShyWriter

[fivealive]

I use the SECURE LOGIN Firefox extension which stores the passwords elsewhere.. (Similar to Opera's "Wand" extension.)

 

RE: https://addons.mozilla.org/en-US/firefox/addon/secure-login/?src=userprofile

 

EDIT: Oopss.. Initial link was the direct install; this link is to the Explanation page.. mea culpa; sorry...

 

Now that sounds interesting, just out of curiosity where is it storing the information?

[mountaintree16]

I have a few saved, but not for anything important where it would be a disaster if someone compromised my password.

[ShyWriter]

Hmmmm.. now upon looking further it integrates with the native FF password manager sooooo... As SNL's Roseanne Roseannadanna used to say, "Nevermind!!"

 

 

[exile360]

NO ONE touches my computer except ME (and I don't save my passwords in my browser ).

[CWB]

you can do as many people do :

do not store or "remember" any passwords on the computer .

tape a cheat sheet with all your passwords next to the computer .

... low calorie logic and security at it's finest ...