Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I wonder, how wise is it to allow Chrome and Firefox to a) remember the passwords b) synchronize them? My gut tells me that if it's not man in the middle who can intercept them, but Google and Mozilla themselves can see them on their servers or with help of their browsers. Of course, they say they won't and the passwords are stored encrypted, but can we know that for sure? Maybe the browsers themselves secretly send the passwords to Google and Mozilla.

I've just begun using keepass recently, therefore at least I have a place where my passwords are stored locally, because previously I stored them only in the browsers and synchronized. And now I think I shouldn't synchronize them anymore.

share|improve this question
17  
I think KeePass is the way to go. .kdbx Files cannot be decrypted without the key. So i keep my KeePass Databases in Dropbox to sync them across my devices. – marstato Mar 9 at 6:42
14  
@marstato, but my question isn't about keepass – アレックス Mar 9 at 12:20
6  
Thats why i wrote a comment :) To answer your questions: no. Do not trust your browsers more than necessary. The main business of browser vendors is to create software that displays webpages; not security. So do not trust them with security related tasks. – marstato Mar 9 at 13:05
2  
@marstato: "…software that securely displays webpages". We can expect them to know a bit about security, and we already trust their clientside security implementations. Of course, their password storage security is a different thing. – Bergi Mar 9 at 19:09
3  
@Tyzoid as long as chrome can decrypt stored passwords without having the user enter a password on every start or every access to the password storage, the security of the password storage is effetictely equal to that of plaintext. – marstato Mar 9 at 19:19

13 Answers 13

up vote 62 down vote accepted

To expand on what @d1str0 said: if the creator of your browser wanted to steal your passwords, it would be trivial to send them to a manufacturer controlled server whenever you entered them - they don't need to bother with the hassle of telling you about sync procedures, or offering to remember passwords. All browsers by default send a certain level of usage data back, usually crash reports and update checks, which could easily conceal password and username data.

However, if any browser was found to be doing this, there would be outcry against that manufacturer - look at the rage directed at Microsoft following the release of Windows 10 with the reporting back enabled there.

Keepass and Password Safe are both open source (so, given sufficient programming knowledge, and a trusted compiler, you can be sure they're doing what they say they are, and nothing else - sufficient programming knowledge may well be a very high level though). In both cases, the encrypted password files should be safe to sync, even to third party sources, as long as the safe password is not provided. Breaking AES (Keepass) or TwoFish (Password Safe) without the appropriate key (the safe password) comes down, as far as we know, to brute force.

Lastpass and 1Password both require you to trust the developers, and sync by default to a remote location. Theoretically, they are safe, but there wouldn't be any obvious way to detect a vulnerability in them relating to storage. If you're concerned about Chrome or Firefox stealing passwords, logically, the same arguments apply to these apps.

Personally, I use one of the cloud based password services mentioned - I've considered the risks and benefits, and balanced the amount of security I'm willing to accept against the ease of use for the service, and decided that for my use cases, it's acceptable. Your acceptable risk might well be different - if you consider AES as vulnerable, for example, keeping a Keepass safe on an encrypted USB key which uses a different encryption algorithm might be a viable option, but uploading the file to a third party service might be "too risky" for you.

It comes down to what you consider safe, having evaluated the options. Many security professionals have considered this problem though, and generally advise using password safe type software over allowing browsers to remember passwords, simply because browsers used to be terrible at it - they allowed access without a master password, and used poor encryption methods. Some of these issues have been addressed now, but old habits die hard!

share|improve this answer
11  
Very true. But unless you have sufficient knowledge to audit the full code base, you can't be sure they aren't exfiltrating data. The same is true of the password safes, but there is a lot less code to look at in those. – Matthew Mar 9 at 11:02
2  
@PyRulez Google Chromium is open source, so you can build that yourself. Google Chromium is essentially Google Chrome without the closed source bits. – BooleanCheese Mar 9 at 14:39
7  
@アレックス: You are entrusting your browser with your password whenever you type it in a form. It's the browser which encrypts the HTTPS request containing your password, so it would be easy for it to steal it before encrypting whether you store it or not. If you trust your browser enough to type your passwords in it, then you already trust their makers (Google and Mozilla) not to attempt to steal your passwords. However, this does not mean you should necessarily trust them with correctly securing your passwords against theft; maybe there's a flaw in their storage software... – Matthieu M. Mar 9 at 16:42
1  
@PyRulez no, but I felt it was worth noting that there is a open source option (although I supposed the password sync feature may not be a part of chromium). – BooleanCheese Mar 9 at 16:58
3  

If you were worried about Chrome or Firefox stealing your passwords, you wouldn't be using them as a web browser in the first place.

An application like Keepass or LastPass can keep your passwords encrypted with a master password.

If you don't use a master password, your web browser can unencrypt your passwords at any time.

It's up to you on what level of security you want.

share|improve this answer
28  
If Chrome or Firefox store the password on a central server that's located in the US the government can simply subpoena them. That's very different from the risk that comes from simply using Chrome or Firefox for normal browsing. – Christian Mar 9 at 10:06
3  
You can set a master password in Firefox which it uses to encrypt your saved passwords, much like LastPass/Keepass. – Phil K Mar 9 at 11:16
18  
@アレックス You keep asking whether we should trust Chrome and Firefox at all. Like d1str0 said, if you don't trust them then you shouldn't use them as a browser at all. You do realize that if they were planning on using your passwords maliciously they'd be able to save off your password without asking for your permission? – BooleanCheese Mar 9 at 14:37
6  
@アレックス The only way to avoid trusting some software with your passwords is to never type in your passwords. You could get an increased level of security by physically disconnecting your computer from all networking technologies, but you still have to worry about passwords getting stored on the machine itself (like your computer log in account) and someone getting physical access. At this point, though, there is no reason to have a password that needs protecting anymore. – jpmc26 Mar 9 at 17:06
2  
@Christian: And that (governmental actors) is not the only thing to worry about. Centralised password stores are also susceptible to attacks or leaks, and we can't be sure their storage format is secure. Compare what happened to Mozilla's MDN database‌​. – Bergi Mar 9 at 19:05

In addition to the answers regarding password managers, there is a moment where you must allow for uncertainty.

To take the example of KeePass: in addition to trusting people who review the code (or trusting yourself to have the knowledge to review it yourself), you also need to trust the provider of the binary (that it matches with the advertised code). Or recompile it yourself and trust that the compiler is correct. And that the OS is trusted as well.

This is a lot of "trust" and there always come a moment where your risk analysis declares that it is "good enough". This "good enough" is what you should look for, relative to other risks.

I am with @Matthew regarding the use of online password managers: you protect yourself against the most probable risk (a site is hacked but you have unique and long passwords thanks to the password manager) vs the possibility that Google/the NSA/[put your favorite organisation here] is after you. if they are after you they will have more efficient ways to get to your data.

share|improve this answer

Do you use a shared computer? If yes, or if your hard drive is not encrypted, then no, don't allow it to save passwords.

I would not allow a browser to remember my password, I find using a password manager far easier. Firefox (and I assume Chrome) allow, but do not require, the use of a master password, which encrypts your stored passwords (It is my understanding that passwords are encrypted regardless, but without a master password, nothing stops anyone from using the stored passwords). Most people fail to use the master password feature, and I think it is due to enabling it being something that needs to be sought out explicitly. Using Firefox 44.0.2, if a site knows your password, you can

Right click the password field > Fill Password > View Saved Logins > Show Passwords (Agree to the prompt).

No authentication required, and everything is in plain text.

What's even easier, and works across browsers?

Right click on password field > Inspect Element (May be named differently) > change the type from "password" to "text"

Again, no authentication required, and everything is in plain text.

share|improve this answer
    
Some websites are starting to use their own custom-made login forms, rather than HTML fields, for which the Inspect Element command may not be available. Of course, in this case, the browser is usually also unable to save the password for you. – Dan Henderson Mar 9 at 22:21
3  
@DanHenderson I wasn't aware of any such site. Can you give any examples? The most 'locked down' site I've ever used was osap.gov.on.ca/OSAPSecurityWeb/public/login.xhtml?lang=en and that has a work around as well (Pressing F12, then manually looking for that password field.) I'd actually be really excited to learn about what goes into making something like what you described! – TeckFudge Mar 9 at 23:23
    
Can't recall offhand, it wasn't very recently that I saw it. But at the time, my impression was that the fields had a similar look to the new type of captcha, where you don't actually need to type anything, just check the box that says "I am not a robot", which, I'm pretty sure, only works because the "checkbox" isn't a simple page element, but an area within a complex control that the browser can't distinguish as a checkbox. – Dan Henderson Mar 10 at 13:27
    
Also I think the site stopped using it because mobile browsers also couldn't tell they were text entry fields and so they'd never pop up the on-screen keyboard. – Dan Henderson Mar 10 at 13:30
    
input password fields are just for stopping shoulder surfing, unless they are using an external bit of software as a login form then you can't just turn off element inspect, the reason the checkbox capatcha is a thing is cookies/local storage – Gilsham Mar 10 at 21:39

Seems to me for the average user there is a reasonable compromise: have your web browser save the less important ones, and save the rest in a more secure fashion.

I have something like 100 passwords for various sites on the internet. Probably 80 of them I wouldn't care if someone stole - they could, at worst, make me look like a jerk on Ars Technica or similar. No money (or insignificant and limited money) is associated with the site and password, and it's not a password I would ever use for something that did have money. Those I let Chrome remember.

The other ~15-20 that I care about - credit card and bank logins, my health insurance site, etc. - I keep in an offline encrypted password manager. It's offline, so in theory it could be lost (though I do have it on two separate devices, but house fires and such are possible); but all of those passwords could be (at some difficulty) recovered if absolutely necessary. In general, though, they're secure from hacking, so long as the passwords aren't recovered from a hack of the site it's a password for of course (and these are unique, complex pass phrases that are likely to be relatively safe even in many of those intrusions).

Finally, my email password is not stored anywhere except in my head. That's because it is the weak point - a social engineering attack combined with access to my email might allow someone to recover/recreate passwords for all of the other locations. I use email enough that I can safely memorize that password (and I do have of course a recovery method for that if not).

share|improve this answer
    
how do you know that your browser doesn't secretly steal your passwords you care about? – アレックス Mar 9 at 16:02
    
@アレックス Sure, that's possible (though I try to use open source browsers when possible, that makes it less likely). The browser storing the password seems a lot more risky, though, as noted in other answers. – Joe Mar 9 at 16:03
    
Why? With a good password manager the browser is just as good, or at least almost as good, as the built-in "remember my password" feature. And your password manager might not like to share power, and keep asking to save the password. You're sacrificing convenience AND security for your "junk sites" with your compromise. – Ben Mar 10 at 17:34
    
@Ben The difference is the cloud. My password manager is offline - there's no cloud access - I have to type the password in by hand, it's just a lookup. Whereas the browser remember-my-password is in the cloud; any Chrome I sign in on, anywhere, has these - at the cost that it might be less secure. – Joe Mar 10 at 17:36
    
I think the key is "robably 80 of them I wouldn't care if someone stole", therefore better to use something EASY to allow different passwords on each website, even if it is not 100% secure its self. – Ian Ringrose Mar 12 at 12:00

A compromise is to use KeePass with the Firefox extension KeeFox which enables you to use passwords from your KeePass password vault with Firefox automatically, without actually storing them via Firefox.

share|improve this answer

The passwords stored this way are extremely insecure. Simply try to access them and you will notice they can be accessed by entering your windows/linux user account password. There were and probably are exploits to change the windows/linux user account password or cirumvent that check. You should thus never store passwords of high value targets like a online banking account, especially on a work computer.

share|improve this answer

It's pretty simple: trusting your passwords to a browser, which, even with good intentions is not its primary function, is always a problem. Especially if the browser has plugins installed or if the password store itself is not secured with a (strong) master password.

How big of a problem? You have to decide. I surely let my private browsers store passwords to unimportant sites, but not for my bank account or personal mail account. The fact that many online banks actually make it hard/impossible to let your browser store the password (by replacing a plain input form with some elaborate scheme, i.e. having to click on a stylized number pad with your mouse instead) should tell you something.

For KeePass etc. it's exactly the same thought, except the bar is raised higher. I.e., if you are truly paranoid, you won't use them either, but you can trust them a "little bit more" than browsers. How much is up to you.

share|improve this answer

There are a lot of responses here with some good information. As pointed out by some of them, whenever you use any software, you are investing some level of trust in that software.

With respedt to browsers and using them to store your passwords, I don't think your main concern should be the browser manufacturer. These are typically larger organisations who have considerable investment in their reputation. They are also under a fair amount of scrutiny (esp. chrome and firefox).

The real threat is from malicious sites/web pages and browser plugins. For this reason, I think one of the most important properties to look for is whether the browser allows you to set a master password for the stored passwords and whether you need to enter that master password before a stored password can be used.

Chrome in particular has been criticised for not providing sufficient security with respect to their stored passwords. I believe the situation has improved, but that was largely due to public out cry.

If you are using something like keepas, then I don't see any real benefit in also storing your passwords in the browser. I use a password manager and disable the ability for all the browsers I use to store passwords as it isn't providing any additional benefit.

I find people often misunderstand the reason for password managers - or emphasise the wrong aspects of them. Many see them from a convenience perspective. They will enable any convenience options without considering what impact that has on security - for example, caching their master password, allowing automatic auto-fill etc. While password managers of any type can be convenient, the real benefit is in reducing the number of complex passwords you need to remember. You need remember just one very complex and strong password and what you want is the ability to enter your master password before the system fills in your 'real' password. You don't really want the convenience of automatically entering the password - accept that level of inconvenience to ensure you keep control.

share|improve this answer

One argument in favour of allowing Browsers to store your passwords, that I have not seen anybody else here make, is that it can protect you against phishing attacks.

Chrome will automatically fill in your login credentials, but it will only do it if the URL is correct... and if the site is well designed, the URL will have been verified by a certificate authority through HTTPS. If you go to a login page and Chrome hasn't filled the credentials in automatically, then that is reason to be concerned and double check that you are in the right place.

share|improve this answer

For online logins, you have the easy tools, like Lastpass with good browser integration, and the ones that require more work, like Keepass, where you have to copy and paste logins. That's a lot more work when you need to login to many sites daily.

If you trust Lastpass (or similar tools) less, then you can still use it for the websites which are not that important.

Important websites - think of Paypal, Amazon, Ebay, where losing your account may cost money, or mail accounts like Gmail or Hotmail, where losing the account may be even a bigger problem as it makes it possible to reset logins at other website.

Lesser important websites: login for a games forum, for Reddit, for a non active Twitter account, for discussion forums etc. Good chance that you can prove you are you and reclaim the account, bad luck if not. It's not a big loss. And whether your Reddit account means your life, for me I really don't care. So I would save it in Lastpass, but maybe you want to keep it safer. What to keep where is up to you.

share|improve this answer

If your passwords are easy enough to remember* or important enough**, it's better to not save them to your computer (in the browser or elsewhere) because then you are practically giving your passwords away if someone steals your computer.
Even if your passwords are encrypted, that is merely a delay mechanism, fortunately not many people will have the knowledge/resources to even bother to crack it and will probably just sell your computer for quick money.
If you do choose to use a password manager, take advantage of it: Generate a random password using all valid characters and make it as long as is allowed (4096 characters might be ridiculous though...).

*don't use short passwords, too easy to brute force (10 characters is a good starting point)
**eg., banking, email, stores, Facebook (can be used to log into other services)

share|improve this answer
1  
sell your computer for quick money ...to the guy who does have the knowledge/resources to crack it. – Dan Henderson Mar 9 at 22:23
    
so where keep them? – アレックス Mar 10 at 9:20
    
If your master password is strong enough, and the stored passwords are not encrypted stupidly, then you'll have PLENTY of time to change any of your passwords needed if somebody steals your computer. Really you shouldn't even need to change your passwords at all, if the master password and encryption method is strong enough. – Ben Mar 10 at 17:26
    
@DanHenderson: I did consider including that. @[asian-characters?]: In your mind. – chinoto Mar 14 at 21:03
    
@Ben: That is why I mentioned that there aren't many people with the resources to crack strong encryption in a feasible amount of time, perhaps there aren't any yet. I do somewhat agree with what you say, but I prefer to avoid having the potential vulnerability exist at all. The encrypted passwords should just be random bytes encoded as whatever characters are allowed, otherwise what's the point in bothering to store them if you can remember them? – chinoto Mar 14 at 21:08

Other users are the most worrisome reason.

I would not use any passsword remembering software, because apart from handing them the passwords I use, there is a much higher risk of someone hacking into your Google account (for example) and dumping all your other passwords.

You can save your passwords in Chrome, and then configure it to backup them to Google. Then, someone hacks your Google account by doing some keylogging.

They can access all your saved passwords in clear-text, right from the profile control panel of your google account.

However, this could be mitigated by the use of TFA.

As I said, I would not ever use any pass-remembering software, but mainly for this reason.

share|improve this answer
    
So, basically, you're going with the common "all your eggs in one basket" argument against password managers. This has been written about extensively by many people (AgileBits, makers of 1Password, have some very good articles on the topic), but the rebuttal generally comes down to likely user actions without a password manager: i.e. password reuse, or some sort of "derived password" you can figure out for each site based on a common base password. Both of these are a very weak way to secure yourself. So you're really choosing between a secure basket and an insecure basket. – Ben Mar 10 at 17:30
1  
In other words, you either trust a program or service made by a bunch of people who know what they're doing security-wise with your passwords; or you trust the security of the weakest website you use your shared password on. There are still websites out there who store passwords in plaintext! I choose to know who I'm trusting with my passwords. – Ben Mar 10 at 17:32
    
Nobody said you nothing about shared passwords. And I am not using them. I have a unique derived password for each site I register on, and is not that easy to guess. And better to trust the security of a website, to trust nobody can relate different email aliases across websites, and to trust your 2FA protected email. THAN – Dark_eye Mar 10 at 23:59
    
to HAND OVER DIRECTLY your clear-text passwords to a company. That is the clearest "all your eggs in one basket" case. (mis typed enter) – Dark_eye Mar 11 at 0:01
    
So...use a local-only password manager like KeePass, Password Safe, or 1Password. Derived passwords are not secure. When 1-3 leak, a computer WILL be able to figure out the derivation. And aside from security of the method, how do you go about changing a password when it is breached, if all your passwords are based on the same derivation? – Ben Mar 11 at 0:11

protected by Jeff Ferland Mar 12 at 5:55

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.