51–60 of 315 posts
has op used any other browser before? They all store pwd in the same way
No.
1. Safari stores its passwords in Keychain (OSX's built-in password manager), in which a master password (the account's password) is required to get cleartexts. Safari itself does not give direct access to the passwords list.
2. Firefox has a master password option.
Now I'd like to remove my saved passwords but visiting chrome://settings/passwords and removing them one at a time will take forever; can anyone tell me how to remove them in bulk?
Earlier quoted context omitted.
This probably is a mistake, far from harmless, but wouldn't it be better to point it out to the Chrome team and try to get it fixed. Have you logged a bug? https://code.google.com/p/chromium/ or Tools > Report an issue...
A mistake..? So they accidentally wrote code to copy your credentials and create a new keychain item which Chrome has permanent access to?
Have you reported the bug and asked the Chrome team about it?
In contrast to adwords defaulting to automatic payments and auto-bidding, or tracking users across the web universally over all the google services, or pushing people to use G+ everywhere, this wouldn't really benefit Google would it? I'm sure Google do lots of evil things, but I can't see any upside to them in this, and lots of downside.
has op used any other browser before? They all store pwd in the same way
It's not very onerous and it prevents quick, casual swiping of passwords. (Sophisticated attackers could navigate to a fresh login prompt and use DOM-manipulation... but that's also more time-consuming and doable by far fewer people.)
Earlier quoted context omitted.
Firefox does have a master password.
I really, really wish there was some way to set it so it wouldn't access your cookies or something unless you put in the master password. Always seemed like a bit of a flaw that while you can't log in to other sites or view the passwords, you could still access any sites you were already logged in to.
Passwords should never be viewable through a browser settings page. If you forget a password for a site, then the site provides a mechanism for password recovery/reset.
To those saying this isn't insane... you are wrong. I can open anyone's chrome browser and access their passwords without a master password? That's plain fucked up. (I realise I could visit sites and use password reset, but this is so frictionless as to be insane)
It's especially insane on OSX which already has an OS-wide and ~secure (more secure than this anyway) password manager: Keychain.
security find-internet-password -g -s news.ycombinator.com
As others said: don't let anybody use your computer if you're logged in (have the keychain(s) unlocked).
I had never given much thought to the implications of saving my passwords in Chrome so thanks for pointing this out. Now I'd like to remove my saved passwords but visiting chrome://settings/passwords and removing them one at a time will take forever; can anyone tell me how to remove them in bulk?
Don't forget to turn of the option to save passwords, and optionally install a password manager extension (I use 1Password).
The problem with what Chrome is doing is that it not only allows anyone to access your "protected" resources (if they have physical access to your browser), but that they can easily peek at, and possibly export those password for use elsewhere (say on entirely different machines / apps) without you knowing or detecting this - since by then, they don't need physical access to your browser. This IMO is the BIG FLAW!
I had never given much thought to the implications of saving my passwords in Chrome so thanks for pointing this out. Now I'd like to remove my saved passwords but visiting chrome://settings/passwords and removing them one at a time will take forever; can anyone tell me how to remove them in bulk?
Select the first, scroll down, hold shift and select the last, click the delete button of any row and all will be deleted. Don't forget to turn of the option to save passwords, and optionally install a password manager extension (I use 1Password).
I use 1Password religiously but until now I'd been lazily saving passwords in Chrome as well to avoid the hassle of entering my master password. I feel slightly ashamed that I just assumed Chrome stored them "securely" and didn't give it any more thought.