1

Is there any security issue if I use for example my Gmail account to store passwords from another resources instead of using any password manager like a KeePass?

If my password for Gmail account is not duplicated on any other resources, it is strong enough and I have 2FA what is the reason to use password manager? Question is only about security. Let's omit user experience, etc.

0
1

Does not sound like a good idea to me.

Benefits of using a cloud-like solution:

  • your passwords are synchronized and backed up automatically.

Drawbacks:

  • you need Internet access whereas Keepass works offline
  • exposing your passwords to hostile actors including authorities that can subpoena for the data

In case you are subject to an legal investigation in your home country, Google may have to surrender all data they have about you, including your E-mails, searches, location data etc. They already have too much information about you.

I can see a couple reasons for not using Google, but the biggest problem is that you don't "own" the Gmail account. It is a single point of failure. If you lose access to that account, then you lose access to your passwords. That can cause severe inconvenience.

You could be locked out of your account for several reasons, including misunderstandings.

  • Example #1: suppose that people are complaining about spam allegedly sent by you, and your account is restricted/closed as a result. Guilty until proven innocent.
  • Example #2: your account has been hacked and Google are making it difficult for you to prove your identity, keep asking supporting documents etc

You might be able to regain access to your account after perseverance, or maybe not. Remember, you don't own it. In fact, if you are using a free service they have even fewer obligations toward you. This is more a favor than a right (time to check the TOS again).

So now the question is, can you get round this problem ?

If you don't know your password, most websites have a reset feature whereby a link is sent to your E-mail address (more rarely, by SMS). But if the E-mail account on file is the gmail account, then you are still stuck. Only manual intervention by a human being can reinstate access to the website, and you'll have to repeat this with other parties.

Now you see how centralization can be a problem.

1

Simply put, using the Google password manager is definitely better than using nothing at all. However, it's really a matter of convenience, browsers were not built to be password managers, it consists of a feature to simplify the user experience.

The security aspect will be strictly limited to the security of your devices that you use to access Google's ecosystem (anybody that has access to the account will be able to consult the vault).

In other words, the native password manager itself is most likely secured, but some simply prefer to not store and aggregate all of their sensitive information in a placeholder built by selling data. I am not stating that they will use the data regarding the stored passwords, but I still think it is better to avoid this by using a third party tool dedicated to storing passwords separately.

1

I know that Google is a serious company, and I would assume that they use good security practices. Nevertheless, storing your passwords on Gmail means that they are accessible to Google, which includes Google admin staff and US governmental agencies because of the Patriot Act.

Being a non US citizen, I would never store my professional account passwords there, or would be blamed by my security team if I did.

On as strict individual point of view I admit that the risk is low, except if you are an international gangster, or a VIP for governmental agencies to spy at you. But do you really thing that a fired employee could not leak private data from their company as a revenge?

Compared to a local password manager or at least a locally encrypted one, using Gmail can only augment the attack surface: if your local system is compromised, chances are that you Gmail account will be too. But you have just make your passwords vulnerable to an attack targetting Google data...

That being said, and IMHO, storing passwords in Gmail is still better than consistently use the same password for every account or storing them in an unencrypted file.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.