Many in the security community are all atwitter about the Chrome browser not encrypting passwords. They call this bad security; a lot of people disagree. I tend to agree with the latter group: putting a master password or otherwise putting some kind of encryption in Chrome’s password store wouldn’t materially increase security, and would give users false comfort. Many other software manufacturers feel the same way (see, for example, Pidgin).
If your browser auto-fills passwords for you without requiring a master password, then you can get at them, asterisks or not. The simple answer is to not store passwords for sensitive accounts in your browser and assume that people can get to them. The longer answer is that you need multiple layers of security. Here are some of the few I use:
1. Use a password manager. This is important, not necessarily because it gets your passwords out of the browser, but because it allows you to stop reusing passwords. This mainly matters if your password is stolen from the server side, but that’s a constant threat. My Zappos password was breached but I didn’t care because I didn’t reuse that password. Do you need to use a unique password for everything? Of course not: that web forum you go on that has no personal or financial data can use a silly little password, and you can even store it in your browser if you want. But for anything tied to money or your online identity, keep it safe.
Let’s be honest, though: just because I use a password manager doesn’t mean my passwords are safe. Malware like keyloggers could grab information. So what else do I do? Lots.
2. Monitor your accounts. My most sensitive accounts are my financial accounts, and I’m sure that’s the case for most people. Every day, I download all of my account data into Quicken (you can use Mint too). Why? First, because I’m super-analytical and need to know the data. But in addition to my irrational desire to analyze, this lets me see if anything weird is going on in my accounts. Waiting a month to get your statement is too late.
3. Don’t use an account with Local Admin Rights for your day-to-day stuff. In Windows, it’s a lot easier to set yourself up with LAR to go about your business. Don’t do it. Set up a separate Admin account (and don’t use the default Admin account, create your own) and use an account with limited rights for normal activities. Of course, put strong passwords on all your accounts.
4. Use malware protection. Windows Defender is good and free. So is Spybot. So are a lot of others. Pick something and use it.
5. Get Acrobat Reader off your computer. Seriously. There’s no reason to have it: plenty of good alternatives exist. It may not be the biggest vector for vulnerabilities, but it’s bad enough.
6. Update your software. Set Windows Update to automatic, and use something like Secunia for your other applications. Java and Flash are particularly important.
This may sound like a lot, but most of this stuff is 100% automated. You just have to spend a few minutes a day looking things over, maybe a bit more for updates. Spending too much time updating apps? Ask yourself if you really need them.
Some people go overboard and claim that you should only access your bank site from a Linux Live CD, etc. Is this more secure? Sure it is. Is it as easy as what I do? Not at all, and I don’t think the delta in terms of extra security is worth the hassle.
Because here’s the ugly truth: even if you do everything, you are going to be compromised. One of my credit card numbers was stolen and used a few weeks ago. I have no idea how it happened. My guess is that it was captured in the recent outbreak of credit card skimmer use. Short of not using cards at all, or inspecting every pump with a close eye before use, there is nothing I could have done to prevent this. Which leads to my last mitigating control:
7. Document everything, and back it up. Document your credit cards, banking info, all of it. Know what accounts are used for what (I have created a handy Visio-like flowchart for mapping out my account flows). Keep phone numbers for customer service. When you are compromised, it will make the cleanup much easier.
This is is a long list, true. But in our connected world, we honestly have no choice. Given everything that you need to keep on top of if you engage in interweb work, do you really think that a master password for your Chrome saved passwords is going to cut it?