1

I've noticed that there are quite a few applications out in the open now to decrypt chrome's password management features. I've seen hacks where a hacker remotes into a computer and runs an app revealing all the saved chrome passwords. What are some anti-measures to prevent this from happening aside from not using the feature all together.

  • Is there a way to encrypt chrome's password management feature so these apps cannot decrypt it?
  • What other alternatives to password management are there?
Improve this question
2
  • Possible related reading security.stackexchange.com/questions/41029/…
    – bobby
    Commented Dec 18, 2014 at 16:13
  • Would a further level of security be provided using EFS to secure the user folder storing Chrome data? In this way you have a direct relationship between OS logon credentials and folder encryption. I tried this option on Win & Pro with no noticeable performance issue.
    – user94129
    Commented Dec 10, 2015 at 3:36

2 Answers 2

Reset to default
1

As far as I remember, like Firefox chrome got a master password function which encrypt the saved passwords. Each time a password is required it will ask you to enter your master password to use a saved credential.

Alternative if you don't want to use native functionality for password protecting, you can use one of numerous software existing for that subject such as Bitdefender password waller which is IMO one of the best one.

Improve this answer
1
  • Firefox asks you to enter the master when you open the browser, but after that it normally doesn't ask you again. You have to enter it again to view the list of saved passwords, but because it doesn't ask you again each time it autofills a password, it has the decrypted passwords or the decryption key in memory (so other processes might be able to access it if they can read Firefox's memory). Your passwords are protected when Firefox is closed but not necessarily when it's open and the password was entered.
    – cpast
    Commented Dec 18, 2014 at 18:24
1

Chrome natively stores passwords using the system provided by the OS to do secure storage. At least on Windows, the Windows secure store does not require authentication for any program to get a particular thing you stored. That means that Chrome prompting for a password to view the list of saved passwords is fundamentally just an annoyance to an attacker; it means they can't use Chrome to view all saved passwords, but if they can launch a program of their choice in the context of your user, they can easily launch one to access the secure store and get all Chrome passwords.

So long as Chrome uses the Windows secure store as its sole password protection mechanism on Windows, there is no way around that issue -- it's inherent to the design of the Windows secure store, which assumes anything a user runs is authorized access to their secure data. It might be different on other operating systems, if their secure storage systems require explicit approval and authentication for a program to access stored data; however, it's not something you can change from within Chrome.

If you want to use Chrome and don't want any other program to be able to access credentials, the only way is with a third-party password manager. Other browsers do things a bit differently (e.g. Firefox has its own master password, instead of using the OS's secure store), but that's the only way to do it with Chrome.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .