A common sentiment, shared by many people down the years, is that storing passwords in browsers is a bad idea. Malware, for example, would specifically target password storage in browsers and plunder everything in sight.
Password managers weren't exactly flying off the shelves back in 2007, your only real options were home grown. People ended up saving logins in all sorts of odd places: Text files, email accounts…you name it. Naturally, security-minded folks gravitated towards saving passwords in browsers, because what else were they going to do?
The browser password wars
Even just 8 years ago, it was still a hotly contested debate. The problem then was that passwords were stored in plain text. They aren't now, but if the device you're using is compromised it doesn't matter. Malware files can decrypt your passwords, or wait for you to do it. So, no matter how recently you look, many of the same threats still exist for browser passwords. And new ones emerge, like the rogue advertisers trying to grab autofill data.
Let's be clear: things are better now for passwords in browsers than they used to be. Even something as basic as having to enter your Windows password to view or copy saved passwords is reassuring. Making use of encryption, instead of leaving data lying around in plaintext, is excellent. Browsers taking things one step beyond simply storing, and checking for stolen passwords is great. Real time phishing protection is the icing on an ever-growing cake.
With that in mind, Chrome continues to make inroads in the name of beefing up browser password safety.
Weak password? Chrome 88 can help
Beginning with Chrome version 88, you can now check for weak passwords (open Settings and search for "Passwords") and alter them on the fly, with just a few clicks. The "Change password" button doesn't alter anything inside the browser, which may disappoint. It simply takes you to the site where you use that feeble password. At this point, you'll have to manually alter the details. The browser should then detect you've altered the password and update its password database, as it normally would.
If you really want to know what the stored password is but can't remember it, you'll need your Windows login, as mentioned earlier.
There's not a huge amount to add about this new feature, as it is indeed incredibly simple to use. A list of all your potentially weak passwords is displayed, and off you go to fix them all. This is to its benefit. It's easy to get bogged down in password minutiae and end up not bothering.
You don't need bells and whistles while looking for weak passwords. You just want a list of sites, and to be told where there's a problem. In this regard, the new functionality more than delivers.
Browser or password manager?
Having said all of that…you may still wish to ignore all the above and stick with a dedicated password manager. No matter what password features are added to browsers, some folks will never want anything to do with that. There are a wealth of choices available. Totally offline, or online functionality: the choice really is yours. I'd be surprised if there isn't something for everyone in the options available. But if you really don't want a password manager, then browsers are a better solution than nothing at all.
Do you prefer to keep all your tools in the browser basket, or cast passwords away into dedicated password managers? Either way, we wish you many years of secure password management to come.
The post Chrome wants to make your passwords stronger appeared first on Malwarebytes Labs.
from Malwarebytes Labs full article here