I have for a long time used a fairly insecure method of having a series of different passwords - where I would use the same password on many sites. I would change between one of the series of passwords for random(ish) reasons and I would store which password I was using at which site in a text file by using a cipher to tell me which of the 6 or so passwords this particular site used. One additional slight positive movement towards being more secure - I use a unique email address at each website I register on.
I am wanting to improve my password security - after all I do have a LinkedIN account, and some others that at times have been compromised, according to pwned
I started by choosing a new set of passwords and began changing some of my accounts. Then realised this would just take me back to where I had been. So I thought about it for a little bit, and have now started using the Chrome "suggest passwords" feature. I have since done a bit more thinking - and figured I should actually evaluate if the Chrome/ Google Password Management is adequate.
This seems fairly secure - and I can't see any password until I enter a password for the device I am using. That gives me some degree of confidence about how secure the Chrome platform is.
My basic requirements for a p/w manager are:
- Online Sync (I use more than 3 devices Every. Single. Day. sigh)
- Able to view the passwords at my discretion. This can be done on my phone. (I will sometimes be at a new device and NEED to use a specific password. This can be up to 2 -3 times per week)
- Ideally Free (Open or Closed Source is fine)
So while advice is welcomed, my specific question is this: "Is Chrome's password management a reasonably level of security, assuming that I protect all of my devices that have Chrome installed and synched to my account?"
I have seen these 2 answers here:
The 1st seems to indicate if someone gets into your gmail account - your passwords are an open book.
The 2nd seems to indicate if someone obtains physical access to your windows or macos or linux device, they have a reasonably good chance of being able to brute force their way in to your store.
Are both of these concerns correct?
And what other concerns should I have about using Chrome as a password manager?