7

Say I use Chrome on a new computer to log in to a website, and I select the option to have the browser remember the password. Then I download a straight-up smorgasbord of viruses of every kind. Can the viruses access the passwords that have been saved by my browser?

  • 1
    The general answer is yes, you should assume they can. – Janis F Jun 22 '16 at 22:07
  • They are encrypted but this is not enoughly efficient. – Xavier59 Jun 22 '16 at 22:10
  • 1
    If a program running on your user account can access some data (like Chrome can access your saved passwords), then in general so can any other program you run on your user account. – Macil Jun 24 '16 at 21:16
7

You should assume so no matter what*

When your system gets compromised you must assume that it has compromised any accounts stored on the system. You should go about changing the passwords for any accounts used on that computer in any place. You have no control over the virus, and you have no control how programs store your data so you don't know if your accounts are safe. As the general rule always assume a compromised computer means compromised accounts.


Password storage in browsers

For most browsers those passwords are stored encrypted, but since the computer is on and the infection has access to memory space it can find the key and decrypt them itself. These infections usually target the browsers specifically, but can also have a wider scope of impact.

The real attack the encrypted passwords protects against is the theft of the hard drive. However if the cipher text is in the memory then it can be found and taken.


Regarding Master Passwords and Password Managers

While convenient, these offer little protection from an infection due to the fact that the cipher text is still loaded into the memory space. These provide protection from sit down attacks, stolen hard drives, and user ineptitude.
They do not protect against an infection that has access to memory space

*: unless you know absolutely how and what and where the infections do their work.

  • 1
    I'm actually worried about an account for which it's impossible to change the password, so it only matters if they steal the password. Can they steal the password itself? – Jeff Caros Jun 22 '16 at 22:15
  • 3
    Yes. If the browser can decrypt the password, so can the virus because at some point the cipher text must be in the memory or storage and the virus can find it. This is why Chrome doesn't bother with a master password. – Robert Mennell Jun 22 '16 at 22:17
  • 1
    Yes but how many viruses do you notice? – Robert Mennell Jun 23 '16 at 1:28
  • 1
    And honestly that is semantics. It's when the key is loaded into the memory regardless of mode master password that you are compromised. – Robert Mennell Jun 23 '16 at 1:32
3

There are methods of stealing browser-saved passwords so you need to assume that your browser is always vulnerable.

At a very minimum, you should set a browser master password and enable encryption to stored passwords. You can also look into using something like KeePass which allows you to store encrypted passwords where you choose (i.e. hard drives, portable drives, and network drives, etc).

Google Chrome, on it's own, is not designed to be very secure. LastPass is another half way decent option for securing browser passwords. LastPass gives you an added layer of protection as you need a master-password to start using it every time. And one of the most important aspects of using LastPass would be that it doesn't show the saved passwords on websites as it is unless and until you initiate LastPass, unlike password keeper.

This may lead to someone changing the form text box type to 'text' to view the contents in your saved password. This can be done using the inspect element feature of your browser.

  • 2
    There's some good information here, but the truth of the matter is it's when the cipher is in memory and the passwords are being decrypted that the cipher is copied. A master password only offers just as much security here as encrypting it in the first place because no matter what you must load a cipher to decrypt the passwords. Password managers are prone to the exact same problem. What a password manager protects against is a sit down threat/stolen HDD. Not a virus. – Robert Mennell Jun 23 '16 at 17:37
  • What you say is true. This is why in my answer I said, "At a minimum". A little security is always better than none. – Yokai Seishinkage Jun 24 '16 at 18:35
  • 1
    It's only changing the cipher text, and probably to something easier to brute force than the one generated for you by Firefox in the first place. This is why the first step to having secure accounts is having a secure password in the first place. The master password really only adds convenience. Firefox encrypts the data by default like Chrome so I'm not sure you gain anything here with one at all other then a false sense of security? google chrome's head of security said it best in an easily googled quote. – Robert Mennell Jun 24 '16 at 18:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.