The Dangers of Saving Passwords in Browsers

In today’s digital world, the convenience of web browsers offering to save user’s passwords may seem like a helpful feature and could be very tempting. However, this convenience can come at a significant cost to your company's security.

Recently, a company’s VPN was hacked because of an employee's use of password storage within a web browser.

What Happened?

The company provided VPN services to their employees, whom were allowed to work from home; where they were given access to the businesses’ internal network and data. Additionally, the employees were able to connect to the VPN on the provided laptops and computers.

The employee who was targeted used their web browser to save the username and password for the VPN site. All he did was press OK when offered by the browser to remember the password after logging in. Later on, the laptop was infected with a virus that targeted all the credentials stored in the browser, including the VPN account of the company. Three months later, the leaked VPN credentials were used to hack the business’ internal network.

We at Infiniwiz understand why it is imperative to safeguard your organization's sensitive information. In this blog, we'll explore the dangers of saving passwords in browsers and why your company should have a strict policy against this practice.

Security Concerns with Browser Password Storage

Access Vulnerability: If someone gains access to your device, they can easily access the stored passwords without even having to log in to the browser with a password. This creates a security vulnerability, especially in shared or public computing environments.

Cloud Synchronization: Also, very often, the browser is set to be signed into a Google account, which then syncs the passwords to the cloud; this, in turn, makes passwords accessible from anywhere on the web and on other devices.

Limited Functionality: Browsers are not designed as dedicated password managers. They lack the robust security features and functionalities offered by legitimate password management software.

Google Browser

More specifically, when you save passwords in your Google browser, they are stored locally and linked to your Google profile. This means:

Persistent Login: Your Google account is almost always logged in within your Chrome browser. This constant login status makes your personal Google account a target for malicious actors.

Lack of Protection: Your personal Google profile does not have the same level of security measures as your company's systems. Therefore, it becomes a possible weak point in your overall cybersecurity defenses.

Cross-Device Usage: Many people use the same Google profile across various devices and applications. This increases the vulnerability of your profile and the passwords saved within it of being hacked.

Increased Risk of Hacking: Since your Google profile is logged into multiple places, it becomes more susceptible to hacking attempts. Malicious actors may target your profile in order to gain access to your stored passwords, compromising not only your personal data but potentially corporate accounts and sensitive company information.

Dedicated Password Management Software

The browser is not a password manager, and it is recommended to use dedicated software for that. Just like QuickBooks isn't a substitute for a full-fledged CRM (Customer Relationship Management) system.

Password management software is built with security as a top priority. It consists of many features, such as encryption, multi-factor authentication, and other security measures to protect your passwords. Password management software allows you to organize and categorize your passwords and will ensure you generate complex and unique passwords. Lastly, many password managers provide auditing and monitoring features, helping you track password usage and changes.

At Infiniwiz, we understand the critical importance of data security and how it impacts the success and reputation of your company. Saving passwords in browsers may seem convenient, but it's a risky practice that can lead to severe consequences. Implementing a strict password policy and educating your employees about password security is essential in today's threat landscape. By taking these steps, you can significantly reduce the chances of a security breach and ensure the safety of your company's sensitive information.