- Nov 1, 2018
- 53
Don't Let Google Manage Your Passwords
Experts tell us that relying on Google Chrome (or any browser) to manage your online passwords is a seriously bad idea. Here's why.
Last edited by a moderator:
Warning: Don't Let Google Manage Your Passwords
- Thread starter numike
- Start date
- Mar 2, 2023
- 1,370
- Jul 27, 2015
- 5,458
- Apr 1, 2019
- 2,881
Yeah, wouldn’t have anything to do with all the affiliate links in their best password manager articles.
- Mar 29, 2018
- 8,026
- Apr 24, 2016
- 7,834
By Tavis Ormandy a vulnerability researcher with Google Project Zero:
Password Managers.
lock.cmpxchg8b.com
- Dec 10, 2022
- 575
I don't let anything manage my passwords I'm safe inside my mind of remembrance. We all know any company can have a data breach, but chips haven't been installed into our brains yet so that's still safe option. Password managers are pointless in my opinion.
You can use something like KeePass with the autofill plugin. You own that database instead of "in the cloud's or "securely stored". KeePass saves on your device and nowhere else (unless you install plugins for that)
- Jan 27, 2018
- 1,562
While that may work well for you, for me, not so much. I could remember 10-15 passwords, but 100 +, not a chance.
- Mar 29, 2018
- 8,026
I place my bet on Tavis' side.
- Mar 17, 2023
- 589
I always let facebook manage my passwords.Don't Let Google Manage Your Passwords
Experts tell us that relying on Google Chrome (or any browser) to manage your online passwords is a seriously bad idea. Here's why.www.pcmag.com
Or use a desktop password manager
- No Extension
- No Browser Password Manager
I would listen to Tavis Ormandy for advice before I take advice from PCmag
- Feb 7, 2023
- 2,359
Neither Travis Ormandy (Google puppet), nor anyone from PC Mag are to be trusted. Saving passwords both in browsers and in a dedicated password manager is always a HUGE security risk for the following reasons:
-A breach will most likely allow attackers to access passwords - that being said, yes, I trust Google to secure their network better than let's say Bitwarden. I mean the revenue streams are not really equal.
-RATs normally exfiltrate passwords - vast majority have been focused on browsers but lately, third-party password managers have been "put under the knife" as well.
In the light of the above, I think it's fair to conclude that the built-in password manager (specially Google one that integrates with Android) is slightly better. It is still unsafe but at least a bit more convenient.
-A breach will most likely allow attackers to access passwords - that being said, yes, I trust Google to secure their network better than let's say Bitwarden. I mean the revenue streams are not really equal.
-RATs normally exfiltrate passwords - vast majority have been focused on browsers but lately, third-party password managers have been "put under the knife" as well.
In the light of the above, I think it's fair to conclude that the built-in password manager (specially Google one that integrates with Android) is slightly better. It is still unsafe but at least a bit more convenient.
- Oct 16, 2022
- 659
It has never been safe to leave passwords saved in the browser, for one simple reason, it has no encryption, the database file that your passwords are saved, anyone with even a little knowledge can access them your passwords, imagine in the hand of a hacker what he can do. To be more direct and specific Chrome stores your passwords in a file called "Login Data". For those who don't know, this file is nothing more than a database in SQLite 3.x format. Using the sqlite3 command, you can access the tables stored in this file, including the logins table, which stores your passwords. I will not detail how to do this, because it would be unethical on my part and it would also violate the MT forum rules, this is a security forum and not a hacking forum. I did a test recently to see if google had changed something and to my surprise nothing has changed, I took advantage and added some passwords for this test, and I was surprised how easy it was to access these passwords saved in this file, and I am no expert. I agree that using an extension-based password manager can be vulnerable. In this case, to mitigate any potential flaws of exposing your passwords from being exfiltrated by the attacker, it is recommended to use a desktop-based PM that does not use an extension or any plugin in your browser. The @Azure is correct in his statement in post #14 Do the test and research for yourself you will be shocked to see the results.
- Dec 7, 2021
- 691
Similar threads
