1

I have a lot (>1000) of credentials for website logins in my Chrome's password safe. Some of them are quite old (> 10 years) and have weak (dictionary) passwords. Some of the accounts have low value to me so that I could just consider them hacked/hackable and abandon them altogether. Other accounts have higher (historic) value to me and I would like to preserve them at least for some time. Because of the sheer amount of credentials, it seems unfeasible to update all accounts to secure passwords manually.

What would be the most secure process to update my credentials and which tools could help me with it? I would execute these tasks manually:

  • Get a list of all websites Chrome has credentials for
  • Request a password reset / update link for a given website
  • Update password to a random password on the website and in Chrome's password safe
  • Set up MFA (multi-factor authentication) where possible
Improve this question
8
  • Although I understand your concern, this question isn't specifically about Info Security. It is either a 'product recommendation' question, or a question about how to script the automation process.
    – schroeder ♦
    Commented Oct 15, 2014 at 15:09
  • Actually it was meant as a 'best practice' question. I can do it manually, script it or use a product myself, but I do not know what the most secure way is.
    – Bengt
    Commented Oct 15, 2014 at 15:18
  • Ah. Then could you update your question to reflect the 'process' instead of 'product' nature of your question?
    – schroeder ♦
    Commented Oct 15, 2014 at 15:22
  • I updated my question, I hope the intent is clear now.
    – Bengt
    Commented Oct 15, 2014 at 15:27
  • 1
    @Marcel From that perspective, every account that is traceable to my identity needs to be secured. That still leaves some (pseudonymous) accounts of low value.
    – Bengt
    Commented Oct 15, 2014 at 16:01

1 Answer 1

Reset to default
1

Use Lastpass and let it import all your passwords from Chrome. Then you have a nice database that can be shared, updated and exported easily.

Improve this answer
8
  • 1
    I don't trust that binary blob enough to give it network access and all my passwords.
    – Bengt
    Commented Oct 15, 2014 at 16:06
  • 3
    But you trusted Chrome to do it.. (and with the click of a button they're in plaintext)
    – cutrightjm
    Commented Oct 15, 2014 at 18:04
  • All relevant parts of Chrome are open source and well audited. I got no results when I googled error messages from lastpass, so it seems sparsely tested.
    – Bengt
    Commented Oct 15, 2014 at 18:12
  • @Bengt in the end this really comes down to personal opinion but I definitely trust lastpass more than Chrome. Chrome does not protect passwords in any way, so you might as well write them down on paper. With lastpass, it's at least protected by a master password and strong encryption. The CEO of lastpass made an interesting post here on stackexchange: security.stackexchange.com/questions/15822/…
    – tlng05
    Commented Oct 16, 2014 at 0:31
  • @user54791 Chrome stores credentials encrypted by default.
    – Bengt
    Commented Oct 16, 2014 at 1:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .