10

There's a few questions here along these same lines already, but they're nearly a decade old. I'd like to know if things have changed, especially now that Chrome has become more aggressive about asking users to save their passwords, and those passwords being associated with a cloud account.

There's lots of rants against Chrome's current password saving policy, and lot's of articles warning against it. However, I don't know if I agree with them all.

Some obvious observations:

Against

  • If someone gets physical access to your machine, there's only the OS password between them and every password you've ever saved.
  • Someone could potentially hack into your Google account, sign into Chrome, and also get access to all your passwords.
  • There's no "master password" (outside of your OS password) to protect them if someone should get logged in access to your computer.

For

  • According to HaveIBeenPwned I have had my email address and passwords shared online dozens of times thanks to hacks to websites. (Including big companies like Adobe, LinkedIn, Kickstarter, etc. and that's just the known hacks.) In that same time I've never had a computer stolen or been subject to a physical security breach.
  • If I use a uniquely generated password on every website, and save them into Chrome, no other websites accounts will be made vulnerable from another website security breach.
  • I probably trust Google to detect and protect me from unusual activity more than almost any other online service (which isn't to say they're infallible, obviously).

In terms of attack vectors, it seems that if you feel you're more likely to be open to a physical attack (or attack from someone you know), then saving passwords into a browser could be a very bad idea.

However if you're more likely to be susceptible to remote attacks by strangers, then having unique passwords stored on every website is likely to improve your personal information's security. (In any case that would obviously be the ideal, but security has to factor in practicality - and the average user isn't going to remember a unique password for every website.)

(I wonder if a better solution to Chrome's current one (which allows users to reuse easily guessed passwords across websites) would be to force (or encourage) the user to only save unique and complex passwords?)

What are the pros and cons of real-life scenarios? And is there any situation you would ever tell a user to save their online passwords in their browser?

8
  • I've always followed the general rule that you should never store any passwords either by writing it down or saving it digitally. But it really comes down to convenience vs security. Another thing to consider is a phone... my buddy had a sim-swap happen and it was a real pain for him. – pcalkins Aug 11 '20 at 21:56
  • 2
    @pcalkins This is precisely what I believe will make you more vulnerable to being hacked. You obviously can't remember a completely unique 16 character password for every website you visit, so you will mostly likely (like most people) have a small stable of passwords you rotate between. When one of those websites is hacked (which is an almost certainty), then one of your stable of passwords could be leaked, opening up your other accounts to hackers. Obviously you may be in a situation where you fear a physical attack more than a remote one, in which case, fair enough, but otherwise... – Django Reinhardt Aug 13 '20 at 11:59
  • I've always been able to remember passwords... I just use fairly long phrases that are easy to remember along with some #s, special characters. Hasn't been a problem for me. I re-use passwords for sites with no connection to banking/purchasing info. For more sensitive logins (banking/merchant/main e-mail accounts) I use unique ones... (though now that I'm getting older, I swear I almost forgot my PIN number the other day...) If I forget there are mechanisms for recovering/changing them. (Though I would avoid using a phone# for 2FA because of that sim swap...) – pcalkins Aug 13 '20 at 17:37
  • 1
    Firefox is quite safe; see links I posted in comment to the posted answer. There's source code and crypto design to pick through if you feel the need. I must say I have looked at the crypto design back when it was published and I found it quite OK. – sitaram Aug 14 '20 at 7:57
  • 1
    @InterLinked I can highly recommend against an encrypted excel file. In general, you should use software that is purpose made instead of making your own concoction. – MechMK1 Nov 12 '20 at 20:12
6

Not as good as a password manager, better than nothing.

Security often comes at the price of convenience, and convenience often comes at the price of security. Password managers built into browsers are primarily there for convenience, and security plays a lesser role. The reason for this decision is that regular users are more easily convinced to use a system that is convenient for them, rather than a system that is more secure, but harder to use.

Since you asked for Pros and Cons of real life scenarios, I'll detail the pros and cons of using a browser's built-in password manager in comparison to an offline password manager like Keepass, and not using a password manager at all.

Using a browser's built-in password manager:

Pros

  • You already have it. Everyone uses a browser these days, and all major browsers come with built-in password managers. This means that from a regular user's point of view, the barrier to entry is incredibly low.
  • It discourages password reuse. People dislike remembering passwords, so they certainly won't remember one password per site. If the browser automatically suggests a strong password upon registering, then the user will not be tempted to re-use an existing password for it. Furthermore, the passwords suggested by the password manager will likely not be cracked by any attackers, should hashes ever be stolen.
  • It syncs to my other devices. A user can register to a service on their computer and then use the same service on their phone without having to worry about syncing passwords. That is a huge plus!

Cons

  • It doesn't defend against local attacks. Attackers which may have access to the computer of the user (think jealous girlfriend, not government agency) may be able to get the passwords rather easily. With access to the browser, for example when a user forgot to lock their computer, all passwords can be read out in a matter of minutes.

    It should be noted that local attacks are not something every user is concerned with. For example, I am living alone and don't really have local attacker in my threat model.

  • It increases attack surface. If synchronization between devices is enabled, then the security of all my accounts is tied to the security of the account of my browser vendor. Furthermore, while it is unlikely, but not impossible, an attacker could steal the encrypted credentials of all users and then begin to crack them bit by bit.

    Since my passphrase is 72 characters long and I use a YubiKey, I am not all too worried about people logging into my Google account - but it could be a reason why you wouldn't want to enable synchronization.

  • Vendor Lock-In. To my knowledge, browsers don't yet offer some way to export all credentials into some unified format. This means, if you have 200 credentials saved into Chrome and decide to switch to Firefox...well, have fun.

Using a dedicated offline password manager:

Pros

  • Better protection against local attacks. Since passwords are stored in an encrypted file, which is protected by a master password and optionally a key file as well, an attacker with local access will likely not be able to steal your passwords. In the case of you forgetting to lock your PC, many password managers have settings to "forget" the key after a period of inactivity. While that doesn't completely protect you, it is much better than a built-in password manager.

  • Better configurability. A browser's built-in password manager may struggle with sites which have less than desirable password policies, so a dedicated password manager can generate passwords according to a specified ruleset.

  • Works outside the browser. Sometimes, I need to generate passwords to send via other means, such as text messages, or use them inside a VM. In this case, a browser's built-in password manager just doesn't cut it.

Cons

  • Higher barrier to entry. Users which don't have a background in security are unlikely to look for a password manager, and if they do, they're likely daunted by the different offers, such as online password managers, offline password managers, etc.. Furthermore, most offline password managers have quite a few very handy features, which are likely confusing for someone who "just wants to use the internet".

  • Doesn't sync between devices. Since my passwords are just a file, it doesn't automagically sync between my devices. If I have a desktop PC, a laptop and a smart phone, then either I manually sync my password database between them, or I use some third-party service to do that for me (like Dropbox, Google Drive, etc.)

Not using a password manager:

Pros

  • Works everywhere. Often times, I need to enter some form of authentication where I simply can't use a password manager, such as for my BitLocker password or my Windows domain password. In such cases, remembering a strong passphrase is the only option I have.

Cons

  • Encourages weak passwords. I won't remember a password like _B+5ZzRk!4vd2+5Q?qw$=9V, that's a fact. I may remember a long passphrase, such as Two Blue Bunnies jump over the Square Tree and Explode., but that's quite a handful to type every time I want to log in. As such, most users will gravitate towards the shortest possible password they deem "good enough", and usually that's something like BostonNovember2020.

  • Encourages password reuse. "I already thought of a password or passphrase, and now you want me to remember a second one? A third even!? What do you mean I need to remember a new pass phrase for every service I use?!" - That's why people re-use passwords.

Verdict

Dedicated password managers are a great high-security option, that offer a ton of configurability. However, as many tools aimed at experts, they can be difficult to use for beginners.

Built-in password managers strike a good middle-ground for non-tech people, increasing their security against likely threats, while making them a bit less secure against unlikely threats.

Using no password manager at all should only be used in situations where no password manager is available.

9
  • I feel like it needs mentioned that plenty of password managers offer sync options, many with "zero knowledge" architectures. You make it sound like offline is the only option. – Ben Nov 12 '20 at 18:33
  • +1 Great answer, however I want to flag some things. "It increases attack surface" -- this is debatable, because "increase" compared to what? Certainly not compared to reusing a password across several websites, which probably the vast majority of current users do. Just a matter of wording really. – Django Reinhardt Nov 12 '20 at 18:52
  • Also, you say wrt offline password managers: "Better protection against local attacks. Since passwords are stored in an encrypted file, which is protected by a master password... an attacker with local access will likely not be able to steal your passwords" This is absolutely identical to browser password managers: They are encrypted and protected by a master password, so what is this "better" to? – Django Reinhardt Nov 12 '20 at 18:55
  • Finally, with regards to "Better configurability" and "Works outside the browser", I personally just use passwordsgenerator.net - I don't see having that in the software as being a huge benefit (or honestly any benefit). I imagine configurability will be added soon with browser password managers, too. – Django Reinhardt Nov 12 '20 at 19:00
  • 2
    @Ben No, offline is not the only option, but I personally have only used offline password managers. I don't feel comfortable talking about online password managers if I don't have experience with them. – MechMK1 Nov 12 '20 at 19:57
1

I can't comment on Chrome unfortunately, considering I haven't used it in a long time. However, Firefox for instance supports using a master password, which means the on-disk storage is encrypted and this protects against most of the physical attacks.

It doesn't appear the master password is shared among logged-in devices though, which makes me assume your passwords are locally encrypted but when sent to your Firefox account, Mozilla would be able to read your passwords. If you don't trust your browser vendor, you probably shouldn't use the browser's builtin password manager so you shouldn't log in with your Google/Firefox account or at least you should disable password sync.

As you mentioned, the practical aspect of having the browser automatically generate and fill in passwords for you is a fairly nifty feature and for the majority of users, imposing that as the default is probably a good idea. It avoids issues regarding password reuse on public websites and the fact that it's built into the browser means more people are using a password manager of some sort, and any (as long as you trust it) is better than none.

If you don't trust the browser's built in password manager, you obviously have some options. There are third-party extensions or you could use a hardware token, both of which would address most of the issues regarding browser security. Also, a middle-of-the-way solution would be to use a system-wide password manager. For instance, I use HP Client Security, because I have the convenience of a password manager everywhere and I also have more options (I use fingerprint+PIN, which I find secure enough).

An extra option in case you deem the browser's password manager too insecure is you could use the browser's password manager for the random, expendable accounts on random sites you don't care about and then use a more robust password manager (your brain is a good one) for the most important passwords (primary email, system passwords and perhaps online file storage). This way you don't keep all your eggs in one basket.

9
  • As a mac user, my local harddrive is bit-level encrypted by default. I assume Windows and Linux must do something similar? – Django Reinhardt Aug 10 '20 at 21:55
  • 2
    "Mozilla would be able to read your passwords" -- not true. Couple of useful links for this: (1) the crypto behind firefox sync, and I have to assume they can't doing worse for passwords: hacks.mozilla.org/2018/11/firefox-sync-privacy and (2) the source code for sync: github.com/mozilla-services/syncserver . Actually, looking at firefox sync settings, passwords also appear to be managed using the same mechanism. So it seems quite safe. I myself use it, though only for low-risk sites like this one and reddit, not my bank or primary email. – sitaram Aug 14 '20 at 7:55
  • 2
    Drive encryption only helps against physical attackers in possession of your powered-down device. While your computer is running, the drive contents are available to running processes, including malware. – Ben Nov 12 '20 at 18:28
  • 1
    @DjangoReinhardt Not by default, you must have FileVault enabled, which to my memory, MacOS asks you if you want to do that or not during initial setup. On Windows, you can use BitLocker and on Linux you can use LUKS. – MechMK1 Nov 12 '20 at 20:07
  • 1
    @PaoloCelati This is false. A TPM is not required for BitLocker or LUKS. – MechMK1 Nov 12 '20 at 20:08
-3

For anyone that believes your passwords are safe in a browser especially against physical 'attackers/intruders', just please follow these steps and realize that's actually a very poor choice to store any password in a browser:

  • Right-click the password field on a website.
  • Select Inspect Element.
  • Double-click on type="password", and replace password with text.
  • Hit Enter, and close the Element Inspector. The password will be un-hashed, revealed for all.

The above steps work, regardless of browser or platform.

This has been documented on various websites, this 'issue' has been around for a while and is not going to be solved any time soon. Wise up, use unique passwords everywhere and use a 3rd party password tool. Also, even that is not foolproof but much better then the current alternatives.

Cheers.

2
  • 2
    Browsers are not designed to protect against local attackers. – MechMK1 Nov 12 '20 at 13:10
  • 1
    This is also true for many non-browser password managers. Your complaint isn't with browser password managers but with browsers themselves. – Conor Mancone Nov 12 '20 at 18:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.