I have a lot (>1000) of credentials for website logins in my Chrome's password safe. Some of them are quite old (> 10 years) and have weak (dictionary) passwords. Some of the accounts have low value to me so that I could just consider them hacked/hackable and abandon them altogether. Other accounts have higher (historic) value to me and I would like to preserve them at least for some time. Because of the sheer amount of credentials, it seems unfeasible to update all accounts to secure passwords manually.

What would be the most secure process to update my credentials and which tools could help me with it? I would execute these tasks manually:

  • Get a list of all websites Chrome has credentials for
  • Request a password reset / update link for a given website
  • Update password to a random password on the website and in Chrome's password safe
  • Set up MFA (multi-factor authentication) where possible
  • Although I understand your concern, this question isn't specifically about Info Security. It is either a 'product recommendation' question, or a question about how to script the automation process. – schroeder Oct 15 '14 at 15:09
  • Actually it was meant as a 'best practice' question. I can do it manually, script it or use a product myself, but I do not know what the most secure way is. – Bengt Oct 15 '14 at 15:18
  • Ah. Then could you update your question to reflect the 'process' instead of 'product' nature of your question? – schroeder Oct 15 '14 at 15:22
  • I updated my question, I hope the intent is clear now. – Bengt Oct 15 '14 at 15:27
  • 1
    @Marcel From that perspective, every account that is traceable to my identity needs to be secured. That still leaves some (pseudonymous) accounts of low value. – Bengt Oct 15 '14 at 16:01

Use Lastpass and let it import all your passwords from Chrome. Then you have a nice database that can be shared, updated and exported easily.

  • 1
    I don't trust that binary blob enough to give it network access and all my passwords. – Bengt Oct 15 '14 at 16:06
  • 3
    But you trusted Chrome to do it.. (and with the click of a button they're in plaintext) – cutrightjm Oct 15 '14 at 18:04
  • All relevant parts of Chrome are open source and well audited. I got no results when I googled error messages from lastpass, so it seems sparsely tested. – Bengt Oct 15 '14 at 18:12
  • @Bengt in the end this really comes down to personal opinion but I definitely trust lastpass more than Chrome. Chrome does not protect passwords in any way, so you might as well write them down on paper. With lastpass, it's at least protected by a master password and strong encryption. The CEO of lastpass made an interesting post here on stackexchange: security.stackexchange.com/questions/15822/… – tlng05 Oct 16 '14 at 0:31
  • @user54791 Chrome stores credentials encrypted by default. – Bengt Oct 16 '14 at 1:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.