4

I have my passwords saved in Chrome and I use Chrome sync. When I am on a public computer I can't sign into Chrome (per google's recommendations https://goo.gl/7cwGsC). Logging into gmail and going to passwords.google.com gets me my passwords, however I can't look at them because my screen is visible to everyone around me.

The only work-around I can come up with is to use a phone vault to store my usernames and passwords for use when I am away from my own machine. Any suggestions or comments about if this is a good fit for the situation would be appreciated. Also, if the file vault would work, a recommendation would be very welcome. Thanks.

2
  • A phone vault works great in that scenario. Is there any reason you're dissatisfied with that?
    – paj28
    Sep 30 '16 at 15:52
  • 1
    No reason I would be dissatisfied. I just wanted to know if I was missing an obvious and easier work-around using utilizing the Chrome-sync set-up. Sep 30 '16 at 19:12
2

I'm not familiar with Google's specific offerings in this regard, but I was facing a similar problem of not wanting to risk exposing the full set of passwords in my password manager when looking up a single password.

I mitigated it by creating a second password manager database which holds only a small number of passwords that I need access to semi-regularly while away from my trusted system. This database has a different master password from the large database.

Consider: You might have upwards of hundreds of accounts in total. If you are doing things right, each account has its own unique password. How many of these accounts do you really log in to often, especially when away from your own computer? Chances are that the latter set is far smaller than the former, and that it is relatively well-defined.

You can then treat the accounts for which passwords are held in the smaller vault as needing password changes far more often because the passwords could potentially be compromised by relatively "mundane" activities.

2
  • Thanks for your suggestion Michael. I went with 1Password (for iPhone) because: it's free, is regularly updated, allows me to turn off all the sync options, and the product seems well regarded. Sep 30 '16 at 19:05
  • Um...1Password isn't free. Or do you plan to use it in read-only fashion after the free trial period ends?
    – Ben
    Oct 4 '16 at 16:06
2

There are a number of approaches you could consider. None of them involve using the browsers password store.

Firstly, you should consider using a dedicated web-based password management tool such as LastPass. Most importantly in this case, this has a one-time password feature that allows use of LastPass on untrusted devices.

You can also add multi-factor authentication options to this for added security.

This doesn't make you completely secure though and you should always assume that an unknown computer is compromised so restrict what you do carefully.

In general using a mobile phone will be more secure than an unknown computer.


UPDATE: LastPass protects you on an untrusted computer because you use a single-use passcode (that you have to have generated in advance). That gets you access to a web page, your "vault". On that page, you can directly launch a password protected site without having to manually type your id and password. For most sites, this will prevent any key-logging or traffic interception of your password.

It goes without saying that you get no protection from this on any site not using HTTPS.

It is also important to note that this only protects against capturing of your passcode. It does not prevent capturing of other information, nor would it help protect against certain malware designed specifically to attack financial sites such as personal banking. An untrusted computer is always untrusted. However, it may be enough for you to grab an image or low-value document from your iCloud or other cloud service or to log into your webmail to check non-sensitive information.

It might also be helpful for me to note that I don't trust LastPass for everything. I also use a stand-alone system called KeePass for really high-value passcodes. This is still cross-platform (e.g. both desktop and mobile) and with an easily copyable file database but can be kept offline or hidden away somewhere. So you could use that as a "phone vault".

I still wouldn't access finance and other high-value sites from an untrusted computer though.

4
  • 2
    I think signing into LastPass on an unknown machine would be just as dangerous as signing into Google Sync for password access. Do it on your phone!
    – Ben
    Sep 30 '16 at 15:10
  • @Ben, normally you would be right of course. However, see my update. Sep 30 '16 at 15:47
  • 1
    Your edit contradicts itself. You say LastPass protects you because of the single-use passcode, then go onto say that malware could steal your passwords. The reality is that a single-use passcode does NOT protect you if the computer is untrusted.
    – paj28
    Sep 30 '16 at 15:56
  • 1
    Nope, I say that malware could steal other information. That's why you don't use untrusted computers for really valuable information. Not ever. It is about RISK. LastPass OTP would give you the ability to, say, use Facebook or Twitter from an untrusted computer but not to manage your bank account. Sep 30 '16 at 15:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.