Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a lot (>1000) of credentials for website logins in my Chrome's password safe. Some of them are quite old (> 10 years) and have weak (dictionary) passwords. Some of the accounts have low value to me so that I could just consider them hacked/hackable and abandon them altogether. Other accounts have higher (historic) value to me and I would like to preserve them at least for some time. Because of the sheer amount of credentials, it seems unfeasible to update all accounts to secure passwords manually.

What would be the most secure process to update my credentials and which tools could help me with it? I would execute these tasks manually:

  • Get a list of all websites Chrome has credentials for
  • Request a password reset / update link for a given website
  • Update password to a random password on the website and in Chrome's password safe
  • Set up MFA (multi-factor authentication) where possible
share|improve this question
    
Although I understand your concern, this question isn't specifically about Info Security. It is either a 'product recommendation' question, or a question about how to script the automation process. –  schroeder Oct 15 at 15:09
    
Actually it was meant as a 'best practice' question. I can do it manually, script it or use a product myself, but I do not know what the most secure way is. –  Bengt Oct 15 at 15:18
    
Ah. Then could you update your question to reflect the 'process' instead of 'product' nature of your question? –  schroeder Oct 15 at 15:22
    
I updated my question, I hope the intent is clear now. –  Bengt Oct 15 at 15:27
1  
@Marcel From that perspective, every account that is traceable to my identity needs to be secured. That still leaves some (pseudonymous) accounts of low value. –  Bengt Oct 15 at 16:01

1 Answer 1

Use Lastpass and let it import all your passwords from Chrome. Then you have a nice database that can be shared, updated and exported easily.

share|improve this answer
    
I don't trust that binary blob enough to give it network access and all my passwords. –  Bengt Oct 15 at 16:06
3  
But you trusted Chrome to do it.. (and with the click of a button they're in plaintext) –  ekaj Oct 15 at 18:04
    
All relevant parts of Chrome are open source and well audited. I got no results when I googled error messages from lastpass, so it seems sparsely tested. –  Bengt Oct 15 at 18:12
    
@Bengt in the end this really comes down to personal opinion but I definitely trust lastpass more than Chrome. Chrome does not protect passwords in any way, so you might as well write them down on paper. With lastpass, it's at least protected by a master password and strong encryption. The CEO of lastpass made an interesting post here on stackexchange: security.stackexchange.com/questions/15822/… –  user54791 Oct 16 at 0:31
    
@user54791 Chrome stores credentials encrypted by default. –  Bengt Oct 16 at 1:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.