How safe is it to store your passwords in a modern browser?

Question

There's a few questions here along these same lines already, but they're nearly a decade old. I'd like to know if things have changed, especially now that Chrome has become more aggressive about asking users to save their passwords, and those passwords being associated with a cloud account.

There's lots of rants against Chrome's current password saving policy, and lot's of articles warning against it. However, I don't know if I agree with them all.

Some obvious observations:

Against

• If someone gets physical access to your machine, there's only the OS password between them and every password you've ever saved.
• Someone could potentially hack into your Google account, sign into Chrome, and also get access to all your passwords.
• There's no "master password" (outside of your OS password) to protect them if someone should get logged in access to your computer.

For

• According to HaveIBeenPwned I have had my email address and passwords shared online dozens of times thanks to hacks to websites. (Including big companies like Adobe, LinkedIn, Kickstarter, etc. and that's just the known hacks.) In that same time I've never had a computer stolen or been subject to a physical security breach.
• If I use a uniquely generated password on every website, and save them into Chrome, no other websites accounts will be made vulnerable from another website security breach.
• I probably trust Google to detect and protect me from unusual activity more than almost any other online service (which isn't to say they're infallible, obviously).

In terms of attack vectors, it seems that if you feel you're more likely to be open to a physical attack (or attack from someone you know), then saving passwords into a browser could be a very bad idea.

However if you're more likely to be susceptible to remote attacks by strangers, then having unique passwords stored on every website is likely to improve your personal information's security. (In any case that would obviously be the ideal, but security has to factor in practicality - and the average user isn't going to remember a unique password for every website.)

(I wonder if a better solution to Chrome's current one (which allows users to reuse easily guessed passwords across websites) would be to force (or encourage) the user to only save unique and complex passwords?)

What are the pros and cons of real-life scenarios? And is there any situation you would ever tell a user to save their online passwords in their browser?

Answer 1

Not as good as a password manager, better than nothing.

Security often comes at the price of convenience, and convenience often comes at the price of security. Password managers built into browsers are primarily there for convenience, and security plays a lesser role. The reason for this decision is that regular users are more easily convinced to use a system that is convenient for them, rather than a system that is more secure, but harder to use.

Since you asked for Pros and Cons of real life scenarios, I'll detail the pros and cons of using a browser's built-in password manager in comparison to an offline password manager like Keepass, and not using a password manager at all.

Using a browser's built-in password manager:

Pros

• You already have it. Everyone uses a browser these days, and all major browsers come with built-in password managers. This means that from a regular user's point of view, the barrier to entry is incredibly low.
• It discourages password reuse. People dislike remembering passwords, so they certainly won't remember one password per site. If the browser automatically suggests a strong password upon registering, then the user will not be tempted to re-use an existing password for it. Furthermore, the passwords suggested by the password manager will likely not be cracked by any attackers, should hashes ever be stolen.
• It syncs to my other devices. A user can register to a service on their computer and then use the same service on their phone without having to worry about syncing passwords. That is a huge plus!

Cons

• It doesn't defend against local attacks. Attackers which may have access to the computer of the user (think jealous girlfriend, not government agency) may be able to get the passwords rather easily. With access to the browser, for example when a user forgot to lock their computer, all passwords can be read out in a matter of minutes.

  It should be noted that local attacks are not something every user is concerned with. For example, I am living alone and don't really have local attacker in my threat model.

• It increases attack surface. If synchronization between devices is enabled, then the security of all my accounts is tied to the security of the account of my browser vendor. Furthermore, while it is unlikely, but not impossible, an attacker could steal the encrypted credentials of all users and then begin to crack them bit by bit.

  Since my passphrase is 72 characters long and I use a YubiKey, I am not all too worried about people logging into my Google account - but it could be a reason why you wouldn't want to enable synchronization.

• Vendor Lock-In. To my knowledge, browsers don't yet offer some way to export all credentials into some unified format. This means, if you have 200 credentials saved into Chrome and decide to switch to Firefox...well, have fun.

Using a dedicated offline password manager:

Pros

• Better protection against local attacks. Since passwords are stored in an encrypted file, which is protected by a master password and optionally a key file as well, an attacker with local access will likely not be able to steal your passwords. In the case of you forgetting to lock your PC, many password managers have settings to "forget" the key after a period of inactivity. While that doesn't completely protect you, it is much better than a built-in password manager.

• Better configurability. A browser's built-in password manager may struggle with sites which have less than desirable password policies, so a dedicated password manager can generate passwords according to a specified ruleset.

• Works outside the browser. Sometimes, I need to generate passwords to send via other means, such as text messages, or use them inside a VM. In this case, a browser's built-in password manager just doesn't cut it.

Cons

• Higher barrier to entry. Users which don't have a background in security are unlikely to look for a password manager, and if they do, they're likely daunted by the different offers, such as online password managers, offline password managers, etc.. Furthermore, most offline password managers have quite a few very handy features, which are likely confusing for someone who "just wants to use the internet".

• Doesn't sync between devices. Since my passwords are just a file, it doesn't automagically sync between my devices. If I have a desktop PC, a laptop and a smart phone, then either I manually sync my password database between them, or I use some third-party service to do that for me (like Dropbox, Google Drive, etc.)

Not using a password manager:

Pros

• Works everywhere. Often times, I need to enter some form of authentication where I simply can't use a password manager, such as for my BitLocker password or my Windows domain password. In such cases, remembering a strong passphrase is the only option I have.

Cons

• Encourages weak passwords. I won't remember a password like _B+5ZzRk!4vd2+5Q?qw$=9V, that's a fact. I may remember a long passphrase, such as Two Blue Bunnies jump over the Square Tree and Explode., but that's quite a handful to type every time I want to log in. As such, most users will gravitate towards the shortest possible password they deem "good enough", and usually that's something like BostonNovember2020.

• Encourages password reuse. "I already thought of a password or passphrase, and now you want me to remember a second one? A third even!? What do you mean I need to remember a new pass phrase for every service I use?!" - That's why people re-use passwords.

Verdict

Dedicated password managers are a great high-security option, that offer a ton of configurability. However, as many tools aimed at experts, they can be difficult to use for beginners.

Built-in password managers strike a good middle-ground for non-tech people, increasing their security against likely threats, while making them a bit less secure against unlikely threats.

Using no password manager at all should only be used in situations where no password manager is available.

Answer 2

I can't comment on Chrome unfortunately, considering I haven't used it in a long time. However, Firefox for instance supports using a master password, which means the on-disk storage is encrypted and this protects against most of the physical attacks.

It doesn't appear the master password is shared among logged-in devices though, which makes me assume your passwords are locally encrypted but when sent to your Firefox account, Mozilla would be able to read your passwords. If you don't trust your browser vendor, you probably shouldn't use the browser's builtin password manager so you shouldn't log in with your Google/Firefox account or at least you should disable password sync.

As you mentioned, the practical aspect of having the browser automatically generate and fill in passwords for you is a fairly nifty feature and for the majority of users, imposing that as the default is probably a good idea. It avoids issues regarding password reuse on public websites and the fact that it's built into the browser means more people are using a password manager of some sort, and any (as long as you trust it) is better than none.

If you don't trust the browser's built in password manager, you obviously have some options. There are third-party extensions or you could use a hardware token, both of which would address most of the issues regarding browser security. Also, a middle-of-the-way solution would be to use a system-wide password manager. For instance, I use HP Client Security, because I have the convenience of a password manager everywhere and I also have more options (I use fingerprint+PIN, which I find secure enough).

An extra option in case you deem the browser's password manager too insecure is you could use the browser's password manager for the random, expendable accounts on random sites you don't care about and then use a more robust password manager (your brain is a good one) for the most important passwords (primary email, system passwords and perhaps online file storage). This way you don't keep all your eggs in one basket.

Answer 3

For anyone that believes your passwords are safe in a browser especially against physical 'attackers/intruders', just please follow these steps and realize that's actually a very poor choice to store any password in a browser:

• Right-click the password field on a website.
• Select Inspect Element.
• Double-click on type="password", and replace password with text.
• Hit Enter, and close the Element Inspector. The password will be un-hashed, revealed for all.

The above steps work, regardless of browser or platform.

This has been documented on various websites, this 'issue' has been around for a while and is not going to be solved any time soon. Wise up, use unique passwords everywhere and use a 3rd party password tool. Also, even that is not foolproof but much better then the current alternatives.

Cheers.