0

I have read about the functioning of Chrome for storing passwords. I realized that it stores an encrypted sql database locally and it also stores them online. I find it more secure to have them only online. Is there a way to store them exclusively online ? Maybe by deleting the local database file ?

1
  • Password manager should not disrupt your sign on when internet connection failure happens, it should works inside Intranet, i.e. sign on to your local intranet web services. So you need to patch it yourself, and/or make a request to Google to add such features override.
    – mootmoot
    Commented Jun 19, 2017 at 8:20

1 Answer 1

0

This would be a rather uncommon request. Historicaly, browsers programmers realized that user had to consistently type their passwords for web sites and decided to store them locally in an encrypted database. Then Chrome decided to allow an automatic synchronization of the encrypted database in the cloud, to allow an easy share between different devices. But AFAIK, you cannot bypass the local database even in Chrome.

But external password vaults exist like for example LastPass. It can be used as a Chrome add-on and stores your password vault in their servers. Of course a temporary local copy must exist locally, because the encryption/decryption is only local so that your master password never reaches LastPass servers. But AFAIK, the only permanent storage is remote.

That being said, local storage is often prefered for password vaults, the online storage being seen as a help for sharing the vault or to have a backup. So IMHO, you should think twice about what are the threats you want to mitigate with a on line only password vault.

5
  • Thank you very much for your answer, it very clear. Actually, I think it's harder to attack the Google' servers than a computer, that's why I would prefer to do that. I'm gonna look at the lastpass solution, but I would more trust a entity like Google than LastPass (not concerning the privacy of course, but for the safety of the data). After all, LastPass has been hacked several times in the past years.
    – KB303
    Commented Jun 19, 2017 at 8:03
  • EDIT : Apparently, even LastPass is storing the passwords locally : lastpass.com/support.php?cmd=showfaq&id=425
    – KB303
    Commented Jun 19, 2017 at 8:09
  • 1
    @KB303 At some point, your passwords will be retrieved to your computer when you use them. A malware can monitor your browser process to copy the passwords, or instrument your browser to retrieve all your password. What threat are you trying to counter by not wanting to have a local copy of your passwords database?
    – A. Hersean
    Commented Jun 19, 2017 at 8:28
  • 1
    @A. Hersean : Indeed, I didn't think to that case. Do you mean that if there is a local malware, there is no way to protect our passwords ? Even a KeePass database would be compromised ?
    – KB303
    Commented Jun 19, 2017 at 8:57
  • 1
    @KB303 If a malware targets specifically your browser or your password manager, you should assume that they are compromised. If a malware manages to have admin privileges, it can compromise any software; if not, most software have bugs that can be exploited to compromise them. (In "most software", I include security focused applications.)
    – A. Hersean
    Commented Jun 19, 2017 at 9:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .