6

I've installed Yandex Browser (Based on Chromium) on Windows 10. I use LastPass for logins so I asked Yandex to not remember passwords.

While I was trying to login to another website, it gave me a pop up saying "You have already used this password for domain1 and hence it is not recommended to use it for domain2" something like that.

If I asked it to not remember password for domain1, then how did it know I was using the same password to login to domain2. This made me suspicious about Yandex like if it was logging my keystrokes or snooping around.

Please let me know if anyone of you have experience with Yandex. Thanks in advance!

Improve this question
4
  • I would guess, that the "Do not remember passwords" feature was only enabled for one site/one password or wasn't enabled at all. At the very least, that would be a very bad implementation of user tracking (which usually is done secretly).
    – Tom K.
    Jan 3 '18 at 11:36
  • So, in my case does it imply that Yandex is indeed tracking my data even when I asked it not to ? I've read recently that Kaspersky is facing some lawsuits etc here: cloudplugged.com/kaspersky-stealing-data So I am a bit skeptical about Yandex since it is Russian too.
    – Sameer Manas
    Jan 3 '18 at 13:58
  • Please, please do not make assumptions like that. Just because a product is from a certain country, doesn't make it a spyware. I would rather recheck if you enabled the "Do not remember passwords"-function or if there's a bug in that functionality.
    – Tom K.
    Jan 3 '18 at 14:12
  • 1
    Another possibility might be the following: you logged in to domain1 and saved the password and then asked yandex to not remember passwords. If I read the documentation correctly, this should still trigger the warning you posted.
    – Tom K.
    Jan 3 '18 at 14:53
3

You can see in the documentation how the password feature works:

After you enter your password on an important website, Yandex.Browser creates a fingerprint (hash) for it and saves it in its database. When you enter passwords on other websites, the browser compares their hashes with the ones in its database. If there is a match, the icon will appear on the right side of the SmartBox to warn you. The browser will ask you to confirm that you want to use the same password on several websites before sending your password to the server.

The best you can do now, is to delete the whole activity in your Yandex Browser and verify each step of the settings, so you could verify that is configured to NOT remember any password that you enter.

Improve this answer
1
  • Based on the description in the link above, it sounds like it possible to store the hash and not store the plaintext. The hash (documentation says its scrypt) cannot practically be reversed. You can turn this protection off. This looks to be separate from internal password manage capabilities.
    – Eric G
    Jan 5 '18 at 2:52
-1

All browser "remember password" features will act as password manager to your password.

So it is not difficult for any browser developer to create such additional password manager features to detect user type in something into HTML input form that resemble password, and use it to check against password repository hash. Any browser plugin/extension password manager actually will do the same.

If you don't like such feature, you can disable them.

Improve this answer
3
  • Not sure if this answers the question - OP points out that they did tell Yandex not to remember passwords.
    – S.L. Barth
    Jan 3 '18 at 9:07
  • Yes. I unchecked "Offer to remember passwords". But still it knew that I typed same password on a previous site. Thats what I was asking about.
    – Sameer Manas
    Jan 3 '18 at 13:56
  • 1
    Then it is definitely a bad bug. You should file a bug report, perhaps using alternate browser until they fix it.
    – mootmoot
    Jan 3 '18 at 16:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.