Not as good as a password manager, better than nothing.
Security often comes at the price of convenience, and convenience often comes at the price of security. Password managers built into browsers are primarily there for convenience, and security plays a lesser role. The reason for this decision is that regular users are more easily convinced to use a system that is convenient for them, rather than a system that is more secure, but harder to use.
Since you asked for Pros and Cons of real life scenarios, I'll detail the pros and cons of using a browser's built-in password manager in comparison to an offline password manager like Keepass, and not using a password manager at all.
Using a browser's built-in password manager:
Pros
- You already have it. Everyone uses a browser these days, and all major browsers come with built-in password managers. This means that from a regular user's point of view, the barrier to entry is incredibly low.
- It discourages password reuse. People dislike remembering passwords, so they certainly won't remember one password per site. If the browser automatically suggests a strong password upon registering, then the user will not be tempted to re-use an existing password for it. Furthermore, the passwords suggested by the password manager will likely not be cracked by any attackers, should hashes ever be stolen.
- It syncs to my other devices. A user can register to a service on their computer and then use the same service on their phone without having to worry about syncing passwords. That is a huge plus!
Cons
It doesn't defend against local attacks. Attackers which may have access to the computer of the user (think jealous girlfriend, not government agency) may be able to get the passwords rather easily. With access to the browser, for example when a user forgot to lock their computer, all passwords can be read out in a matter of minutes.
It should be noted that local attacks are not something every user is concerned with. For example, I am living alone and don't really have local attacker in my threat model.
It increases attack surface. If synchronization between devices is enabled, then the security of all my accounts is tied to the security of the account of my browser vendor. Furthermore, while it is unlikely, but not impossible, an attacker could steal the encrypted credentials of all users and then begin to crack them bit by bit.
Since my passphrase is 72 characters long and I use a YubiKey, I am not all too worried about people logging into my Google account - but it could be a reason why you wouldn't want to enable synchronization.
Vendor Lock-In. To my knowledge, browsers don't yet offer some way to export all credentials into some unified format. This means, if you have 200 credentials saved into Chrome and decide to switch to Firefox...well, have fun.
Using a dedicated offline password manager:
Pros
Better protection against local attacks. Since passwords are stored in an encrypted file, which is protected by a master password and optionally a key file as well, an attacker with local access will likely not be able to steal your passwords. In the case of you forgetting to lock your PC, many password managers have settings to "forget" the key after a period of inactivity. While that doesn't completely protect you, it is much better than a built-in password manager.
Better configurability. A browser's built-in password manager may struggle with sites which have less than desirable password policies, so a dedicated password manager can generate passwords according to a specified ruleset.
Works outside the browser. Sometimes, I need to generate passwords to send via other means, such as text messages, or use them inside a VM. In this case, a browser's built-in password manager just doesn't cut it.
Cons
Higher barrier to entry. Users which don't have a background in security are unlikely to look for a password manager, and if they do, they're likely daunted by the different offers, such as online password managers, offline password managers, etc.. Furthermore, most offline password managers have quite a few very handy features, which are likely confusing for someone who "just wants to use the internet".
Doesn't sync between devices. Since my passwords are just a file, it doesn't automagically sync between my devices. If I have a desktop PC, a laptop and a smart phone, then either I manually sync my password database between them, or I use some third-party service to do that for me (like Dropbox, Google Drive, etc.)
Not using a password manager:
Pros
- Works everywhere. Often times, I need to enter some form of authentication where I simply can't use a password manager, such as for my BitLocker password or my Windows domain password. In such cases, remembering a strong passphrase is the only option I have.
Cons
Encourages weak passwords. I won't remember a password like _B+5ZzRk!4vd2+5Q?qw$=9V, that's a fact. I may remember a long passphrase, such as Two Blue Bunnies jump over the Square Tree and Explode., but that's quite a handful to type every time I want to log in. As such, most users will gravitate towards the shortest possible password they deem "good enough", and usually that's something like BostonNovember2020.
Encourages password reuse. "I already thought of a password or passphrase, and now you want me to remember a second one? A third even!? What do you mean I need to remember a new pass phrase for every service I use?!" - That's why people re-use passwords.
Verdict
Dedicated password managers are a great high-security option, that offer a ton of configurability. However, as many tools aimed at experts, they can be difficult to use for beginners.
Built-in password managers strike a good middle-ground for non-tech people, increasing their security against likely threats, while making them a bit less secure against unlikely threats.
Using no password manager at all should only be used in situations where no password manager is available.
Appendix A: How can a local attacker actually get the passwords?
One of the downsides of browser-based password managers is that they don't protect against local attacks. I will explain one possible local attack for demonstration purposes:
Let us assume Bob stores all his passwords in Chrome. Bob leaves the house to buy groceries and forgot to lock his computer. Eve, Bob's jealous girlfriend, suspects that Bob may not be faithful to her, and wishes to check his various online accounts to see if he has been flirting with other women. She has about 30 minutes of direct access to his browser.
The first thing Eve does is to open Chrome's internal password page. This can be done via the settings menu, or by directly calling the URL chrome://settings/passwords. In this list, Eve sees all pages for which passwords are saved, as well as the corresponding usernames. This alone already may be revealing sensitive information. On this page, Eve could click the "Show Password" button, but that prompts her to enter Bob's OS password, which she does not have.
However, she can still manually recover the password for arbitrary sites. For example, she is most concerned with the sites bookofface.es and bird.app. She can manually navigate to these sites, where she is met with a login form. The browser will automatically enter Bob's credentials into the login form, but the password is blanked out, due to the type="password" property of the input field. By opening the developer console and removing that attribute, the password is revealed in plaintext.
While this process is not as fast as a "copy all passwords" script, it is still doable within a reasonable amount of time. Depending on the goals of the attackers, certain sites may be more relevant than others. So while Bob may have passwords saved for hundreds of sites, Eve may only be interested in a couple.
