Chrome Saved Passwords

[Iain Johnson1]

Not sure if this would need to be in a different forum but thought it relevant here as a lot of pixel users will use Chrome.

My question is about the safety of the chrome Saved passwords. Chrome has a habbit of keeping you logged in unless you make the effort of logging out - something that I have forgotten to do multiple times at work etc... But when I looked today under saved passwords it gave me a long list including being able to see the passwords themselves...

Is this not a really insecure system? I understand that all passwords should be different and I try to go with this. But if someone found out my chrome / Google login then they could know every password and where to look.

 

[methodman89]

If you're computer isn't set to time out, requiring a password to awaken, I don't think you understand how it works. You signed in, you need to sign out. Should it do it for you? If so, when?

 

[18t]

If your phone/computer is locked, no one can view the passwords. In the case of computer, you have to enter credentials twice to view them.

Keeping you signed in is not a chrome specific feature. Don't all browsers do this?

If you are that concerned about it, why not just use incognito mode? Then you won't have to worry about logging out as no cookies etc will be saved, and you will still have your saved passwords available for use.

 

[lcneed]

I think normally you are not protecting yourself against someone knowing your one password that have access to all your passwords. Password managing system is more to protect against individual password accounts and if one of them is compromised, your other passwords are not at risk. A lot of people that does not use password management, use the same password for multiple sites. So lets say you join this new forum on Pixel 3 and they have your email and password and a hacker got hold of them. Now they could try the pair on all the banking sites, paypal, ebay, etc.... and probably will be able to get in a few of them and move your money out.

Some password management will let you set up 2-factor authentication. So they have to know your password to all the passwords AND have a hold of your phone to access your other passwords.

 

[Iain Johnson1]

I work in multiple locations with a few computers, it's not just my individual laptop - that's straight forward. But I use Google sheets etc regularly on one or more. It's not uncommon to occasionally forget to log out of this, I'm on human. I never said it was a chrome specific issue. But when I log onto my outlook email it will log me out if I close the browser. For Google I have to manually log out of it, simply shutting the machine down or closing the browser does not do this.
If there is a setting available to change this I'm all ears.

And my point about the passwords is that if someone managed to gain access to your Google password (just one password) then they'd not only have all your other passwords but also where to look for them. I.e. if someone guessed my password for X they wouldn't necessarily know that I had an account with Z to log in... but with this they would.

I'm not bashing I'm genuinely asking a question in case there is a solution, or if it's someone nobody else worries about.

 

[Almeuit]

I work in multiple locations with a few computers, it's not just my individual laptop - that's straight forward. But I use Google sheets etc regularly on one or more. It's not uncommon to occasionally forget to log out of this, I'm on human. I never said it was a chrome specific issue. But when I log onto my outlook email it will log me out if I close the browser. For Google I have to manually log out of it, simply shutting the machine down or closing the browser does not do this.
If there is a setting available to change this I'm all ears.

And my point about the passwords is that if someone managed to gain access to your Google password (just one password) then they'd not only have all your other passwords but also where to look for them. I.e. if someone guessed my password for X they wouldn't necessarily know that I had an account with Z to log in... but with this they would.

I'm not bashing I'm genuinely asking a question in case there is a solution, or if it's someone nobody else worries about.

Well this is no different then any password manager in existence. You have a "master password" for your vault and then you have all your other passwords stored. If someone was to login to your PW manager then they would have access to ALL your passwords.

The main thing with PW managers is you are not supposed to allow people to log into them. The Master Password (in this case your Google one) is supposed to be a hard one that only you know / remember. Along with that you are supposed to have a 2nd factor for it as well to ensure they can't just get your password and be in.

So to answer you first question -- I am not worried about it since you have to take some initiative if you plan to use a PW manager. They are amazing and fully worth it but you can't just be lax with it and then wonder how it isn't secure. Security always takes layers + time + sometimes things that aren't the most convenient.

As for your Outlook email it will log you out of the browser... IF... you didn't select the "Remember me" when logging in. Google will do the same thing. When logging in uncheck the "Remember me" but I do agree that I wish Google kept that option when logging in (seems to have gone missing). So for that I would suggest just being very mindful. I value my Google account a lot so I haven't ever run into forgetting to log out since it is a prime thing to do when I am done (especially if on a PC that isn't mine at home).

TBH I would suggest using a real password manager like LastPass or something. What Google is doing is good for most people but if you truly are worried I wouldn't link your Google w/ all your passwords. Also I would highly suggest you get into 2FA for any / all accounts you can if you aren't using it (from what you said earlier it sounds like you are just using PW).

 

[Iain Johnson1]

Thanks for the reply - this answered all of my questions.

I'm not overly worried I just thought maybe I was missing a trick with the login thing. I often miss obvious things

 

[Almeuit]

Thanks for the reply - this answered all of my questions.

I'm not overly worried I just thought maybe I was missing a trick with the login thing. I often miss obvious things ??????

No worries -- never hurts to ask .