How do I protect my passwords from WebBrowserPassView?

Question

I just got shocked with what can be achieved with WebBrowserPassView. It basically shows every password I've saved in my browser (Chrome).

I guess other users on my PC could get my passwords that easy too. How do I secure my passwords?

Answer 1

You're really asking the wrong question here

Really what you should be asking is:

Should I be worried that I can use tools to look at passwords stored in my Chrome browser?

And the answer to that is... Kind of. Really the best way to prevent that from happening is to keep your systems hardened. If someone gets access to that data, you've already lost everything. That's because at that point they have gained access to your OS/Computer as a whole and can do whatever they want. They have access to your browser, which means they can hijack your sessions easily, and do any damage they want all without ever having to sign you out of that session. This is true of any open sessions you have on your browser at the time, regardless of whatever password manager you use.

Why?

Because Chrome already stores your passwords in the encrypted user area of your disk.

Really using a master password as an encryption versus the already encrypted areas of your OS is nothing more than security theater. If they get that sort of access to your machine where they can get that file anyways, it's game over man. They have full control over your entire system.

How do I prevent this from happening?

By keeping your computer safe and secure. Don't lend access to it to people you don't trust, don't leave it unlocked, don't use a weak password, and don't just leave it unlocked when you walk away. Did I mention don't leave it unlocked if you aren't using it?

A great post on it from Justin Schuh:

I'm the Chrome browser security tech lead, so it might help if I explain our reasoning here. The only strong permission boundary for your password storage is the OS user account. So, Chrome uses whatever encrypted storage the system provides to keep your passwords safe for a locked account. Beyond that, however, we've found that boundaries within the OS user account just aren't reliable, and are mostly just theater.

Consider the case of someone malicious getting access to your account. Said bad guy can dump all your session cookies, grab your history, install malicious extension to intercept all your browsing activity, or install OS user account level monitoring software. My point is that once the bad guy got access to your account the game was lost, because there are just too many vectors for him to get what he wants.

We've also been repeatedly asked why we don't just support a master password or something similar, even if we don't believe it works. We've debated it over and over again, but the conclusion we always come to is that we don't want to provide users with a false sense of security, and encourage risky behavior. We want to be very clear that when you grant someone access to your OS user account, that they can get at everything. Because in effect, that's really what they get.

Answer 2

If you have saved your passwords in the browser's password store, then they can be read from the browser's password store, and there's no way around that. The reason that Nir's tools works is that the browser makers have not given proper consideration to secure storage, and you can't fix that yourself.

Your alternative is to switch to a real password manager that uses a browser extension, such as LastPass. (There are others that work the same way, but LastPass is the only one which I use so it is the only one I can write specifically about.) LastPass stores your passwords encrypted with your master password, so you can't retrieve them by using a third-party tool to read the database file in which they are stored. You should also set the browser extension to re-prompt you for the Master Password at whatever interval fits best with your computer use, so that someone else can't browse your password vault from the browser.

While third-party password managers are theoretically vulnerable to some of the same issues as the built-in storage mechanism, the fact that password storage is their primary focus usually means that they do a better job.