Why Saving Passwords in the Browser Is a Security Risk
Browsers, while convenient, often lack advanced security features to protect stored passwords from sophisticated attacks, malware, and unauthorized physical access. Beyond those risks, passwords stored in the browser lack the centralized oversight and policy management needed to ensure high password security. Lacking features like secure password sharing and separation of personal credentials, browser password managers fall short of cybersecurity best practices in the workplace.
Overview of the security risks associated with saving passwords in the browser
Saving passwords in web browsers might seem handy, but it can lead to inefficiencies and vulnerabilities that malicious actors can exploit. Security risks may include:
- Malware can find the local files where the browser stores passwords and send them to a hacker.
- Keyloggers capture everything a user types, including passwords added to a browser password manager.
- Software exploits take advantage of vulnerabilities in the browser's software to access stored passwords.
- Session hijacking gains access to an active browser session to view or steal the stored passwords.
- Shared or public computers that give others physical access to that machine may lead to theft of stored passwords.
- Stolen devices that lack encryption or proper security protections can put passwords at risk.
- Malicious extensions can access stored passwords if given sufficient permissions.
- Poorly designed extensions can have security flaws that hackers might exploit.
- Fake browser interfaces can trick users into revealing stored passwords.
- Man-in-the-middle attacks intercept user and browser communication, gaining access to credentials.
Of course, every browser is different. There are also ways for admins to enhance browser-level security and attempt to protect passwords stored there. But, browser password managers are more exposed to many local and virtual attacks by default.
Explanation of how browsers store and manage passwords
Browsers like Google Chrome, Mozilla Firefox, and Microsoft Edge offer built-in password managers that store passwords locally on the device. The browser associates the passwords with a specific user profile or browser account. Browser password managers often store passwords as locally encrypted files that users can decrypt and access using a master password or the device's credentials. Users can access passwords on another device if they enable sync and log in to the same browser with the same user account.
When using the browser password manager, the browser prompts users to store new logins. The browser password manager then recognizes website addresses that match stored credentials and offers to fill them. Browser password managers typically provide a basic page where users can view, edit, or delete stored credentials.
Examples of real-life security breaches resulting from saved passwords
Unfortunately, some malware specifically targets browser-stored passwords, exploiting browser security weaknesses.
For example, the RedLine Stealer "is a malware strain designed to steal sensitive information from compromised systems. It is typically distributed through phishing emails, social engineering tactics, and malicious URL links" according to Cisco's Splunk Threat Research Team. In the past few years, RedLine campaigns have targeted enterprise and personal devices to steal browser credentials, credit card information, and even crypto wallets.
Since three-quarters of all cyberattacks start with a suspicious email, businesses must mitigate the potential effects of phishing attacks that aim to install malware and extract data. Unlike browser password managers, an independent business password manager centralizes oversight of company-wide credentials and provides accurate metrics about password security while locking login data behind additional layers of protection.
The Importance of Implementing Password Management Policies
Password management policies establish a structure for maintaining strong, secure passwords across the organization. They should be well-documented, clearly communicated, and frequently reinforced to employees. These policies set the standard for how employees should handle passwords in the workplace, including where they can store them. A well-defined password management policy can also increase compliance with industry standards and regulations, including meeting cyber insurance requirements.
Benefits of having a password management policy in place
A robust password management policy ensures employees follow best practices for creating and storing passwords. These policies ensure that employees create complex, unique passwords. Additionally, password management policies can enforce added protection like multi-factor authentication. They can also discourage unsafe practices, such as saving passwords in browsers. By formalizing these guidelines, businesses can protect digital assets and foster a culture of cybersecurity awareness among employees.
Setting up password policies that discourage browser password saving
Written password policies should clearly state that employees cannot store passwords in browsers. IT should communicate this expectation to employees both during new employee onboarding and in annual security training. Additionally, IT departments can configure browser settings and deploy group policies that turn off password-saving features across all company devices.
Enforcing password complexity requirements and regular password updates
Password complexity is crucial to password security. Organizations should enforce policies that require employees to use random, complex passwords that include a mix of letters, numbers, and special characters. A password manager with a built-in password generator can make creating and using complex passwords easier. Semi-regularly changing passwords also limits the time hackers can use a compromised password. Automated reminders and system-enforced password expiration can help maintain this practice.
Using multi-factor authentication to enhance security
Multi-factor authentication (MFA) adds an extra layer of security by requiring users to provide two or more verification factors to access their accounts. The additional "factor" could include something they have (a smartphone or security token) or something they are (biometric verification like a fingerprint or face scan). Implementing MFA makes it significantly harder for attackers to gain access, even if they have access to a stolen password.
Educating Employees on Password Security Best Practices
Employees are often the first defense against cyber threats. Well-informed employees who understand the importance of strong, unique passwords and the risks of poor password management can significantly reduce the likelihood of security breaches. Education on common password mistakes and phishing attempts, as well as password managers, empowers employees to implement strong cybersecurity practices. A proactive approach strengthens the organization's security posture and fosters a culture of vigilance and responsibility.
Training employees on the risks of saving passwords in the browser
Educating employees about the risks associated with saving passwords in browsers is critical. Regular training sessions and workshops can help employees understand the potential consequences of poor password management. Providing real-world examples and case studies can make the risks more tangible and motivate employees to adopt better practices.
Importance of password hygiene and best practices
Good password hygiene is essential for maintaining security. Management should train employees on best practices, including:
- Unique, complex passwords
- Long passwords
- Use of passphrases for master passwords
- Keeping passwords private
- Use of MFA where possible
- Storing passwords in approved places
- Updating passwords semi-regularly
- Awareness of phishing attacks
Tips for avoiding common password mistakes
The best way to avoid common password mistakes is to equip employees with helpful cybersecurity technology and offer appropriate training. Tips include:
- Require the use of a business password manager
- Use a password generator to create passwords
- Develop and communicate clear password policies
- Incorporate password security in recurring security training
- Leverage admin reports and alerts to identify and improve poor password behaviors
Even with education and awareness, employees need digital tools to implement best practices. A combination of tools and training will help to avoid common password pitfalls.
How to Turn Off Google Password Manager
After turning off the password manager, the browser will no longer prompt employees to store passwords. Instead, businesses can encourage using more secure, dedicated password management tools.
Step by step instructions
For an employee to turn off this feature in Google Chrome:
- Open Google Chrome and click on the three vertical dots in the upper-right corner to open the menu.
- Select "Settings" from the dropdown menu.
- In the left sidebar, click on "Autofill."
- Click on "Google Password Manager."
- In the left sidebar, click "Settings."
- Under the "Offer to save passwords" section, toggle the switch to turn it off.
By following these steps, employees can prevent Chrome from offering to save their passwords, reducing the risk of storing sensitive information in the browser.
How to make sure Chrome Password Manager is disabled
To ensure that the Chrome Password Manager is fully disabled, employees should verify the settings:
- Open Google Chrome and navigate to "Settings."
- Click on "Autofill" and then "Passwords."
- Confirm that the "Offer to save passwords" toggle is off.
- Check that the "Auto Sign-in" feature is disabled.
For organizations, IT departments can deploy group policies that enforce these settings across all company-controlled devices, ensuring the password manager is consistently disabled for all users.
Saving passwords in web browsers is convenient for employees but can expose organizations to operational inefficiencies and security risks. Businesses should implement robust password management policies, enforce password complexity requirements, and educate employees on best practices. Disabling browser password managers and encouraging dedicated password management tools will help to protect sensitive information and maintain a strong security posture.
To see a business password manager in action, start your LastPass trial.
