7

I'm currently using WIN+L, and sometimes Kid-Key-Lock, to prevent anyone from checking my storaged passwords but if I forget doing it only once, all of them are vulnerable of theft.

How can I protect my passwords from this glitch or is it not possible?

Improve this question

3 Answers 3

Reset to default
3

This doesnt relate specifically to Chrome, but you could take a look at services like lastpass, or keepass. I'm not very familiar with Keepass, but I know that Lastpass uses browser plugins to notice when you are creating new accounts or attempting to login and will fill in the username/password for you automatically. Your credentials are then stored in an encrypted format (AES-256) and only accessible once you enter your master password. The plugins also have features to automatically log out of the vault after a given time period so that if you forget to close your vault and walk away from the computer, it will close itself. One of the other features is the ability to require the master password to be re-entered for specific sites even if your vault is open. This can be used to protect sensitive sites (banking, online tax return, etc) even if you forget to close your vault and the inactivity timer hasnt closed the vault yet.

lastpass is a commercial offering which stores your vault on their servers. If you are uncomfortable with that I'm sure keepass has very similar or identical features, but does so locally on your machine so that your vault doesnt go anywhere unless you copy it somewhere.

Improve this answer
1
  • You can add AI Roboform to the list as well (I'm using it) -- commercial app.
    – LazyOne
    Sep 15, 2011 at 8:57
2

Chrome currently doesn't have a "Safe Master Password" feature, and according to this article (http://www.google.com/support/forum/p/Chrome/thread?tid=5f249c4fa04ecd17&hl=en), no plans to develop.

There are a couple pros and cons with the use of a Safe Master Password.

Some Pros:

  1. All passwords are locked by your master password, and if you are careful with it you should be in good shape, barring some nightmarish exploit.
  2. All your passwords are available within the browser, makes it easy to use them and you don't need to write them down or put them somewhere potentially less secure.
  3. Managed within the browser, you don't have much of an excuse to use a easy password, or a repeatable password.

Some Cons:

  1. That master password could get captured by a keylogger, and then you're up a creek. (which is one of Google's responses)
  2. If the browser gets exploited, all your passwords are potentially available to an attacker, over the same vector they just infected you on. Potentially, they could compromise every site you have stored. This would be a wonderful way to grab many credentials for online banking very very fast.
  3. The encryption on the harddrive MIGHT be defeated by resetting an admin password using one of many open source tools or mounting the drive on another OS, rendering it open to evildoers anyway. (NOTE: I have no idea how the mechanism in chrome works, but it's what I would if I were evil.)

I disagree with Google's assessment, most of these types of password based thefts are internet based, not physical theft based. The person who steals your laptop generally wants your laptop, not your credentials. It's just too difficult and risky to make a living by grabbing one laptop at a time. The addition of another master password, added in with the encryption chrome uses by default, would make a really strong combination in this type of theft. Additionally, all it takes is an export of the passwords according to this article (http://www.google.com/support/forum/p/Chrome/thread?tid=271fcd1030121083&hl=en) to reload a browser with all your dirty little secrets. If someone is going to secure my passwords, I want to hold the master password, not Google.

But, this brings up another issue: If your laptop IS stolen, how the hell are you going to know what passwords even need changing if they are locked in the browser?

This is why I use PasswordSafe (or it's cousin, KeePass). This way, I have a master password, it's separate from my browser, and I can back up the file somewhere besides the Google cloud (which is coincidentally secured with a Google password inside the Chrome browser). I also have a record of what passwords I need to change in the event that the laptop is stolen.

Google should reconsider it's position regarding a master password in Chrome. At the end of the day, it's an option you can choose to exercise, or ignore, at your respective peril. I recommend you tell them, I will be too.

Mike

Improve this answer
0

I have found this link which points to a chrome extension from chrome store which can be helpful.

I am not sure where & how securely it stores the master password.

One more drawback is it shows the master password in plain text when you are entering it.

Also it won't let you use chrome at all until you provide the correct master password, after setting it in the extension.

But still it could be helpful & its free.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .