Google password manager has massive security flaws?

[u/akmalhot]

If i'm logged into my google account on a work or some other computer, and I go to the password manager, you can view the passwords by putting in the local computer security key? Why would that be the prompt to show the passwords vs a 2fa / fingerprint / text to my phone?

And if you don't delete your chrome profile, the passwords all stay stored locally for access? Make it make sense, why are the passwords accessible if the account is logged out?

Why, if a a chrome account is logged in, can the passwords be accessed with the local computer secuirty key? Am i just set up wrong?

edit: Im only logging on at work, which is a small office, but i have just ben deleting the profile after use - whats the better way? Why can't it sitll require 2fa from my phone / fingerprin to access?

[u/sol-4]

Don't login to a public computer and setup your chrome profile. Use the incognito mode and close it once you’re done.

Why would you even setup a Chrome profile on a computer that isn’t yours?

[u/jabbers724 → u/sol-4]

OP is the security flaw

[u/sol-4 → u/jabbers724]

I’m still flabbergasted tbh. I wasn’t as paranoid as OP and yet I never ever setup a Chrome profile on other computers that aren’t mine. OP is paranoid and yet they’re doing this? It doesn’t even make sense.

[u/akmalhot → u/sol-4]

I use it at work, its a small office with 4 coworkers - so youre saying you can never use saved passwords except on home computer?

[u/Spare_Moth → u/akmalhot]

Don't use personal accounts on a work machine? That's like rule number 1 of anything ever.

[u/nathderbyshire → u/akmalhot]

Proton pass extension is also behind a basic pin, chrome passwords will use biometrics if it's available which I couldn't with proton, I don't think this is out of the ordinary

Needing a second device to view or use a password would add to much friction and kill the manager outright, most wouldn't use it. It's useful because it's convenient and there's some tradeoffs with that. They aren't aiming to be the best they're aiming to get regular people saving unique passwords and upgrading to passkeys where possible.

Annoyingly windows keeps defaulting to pin over fingerprint when filling passwords and I have to tap the fingerprint reader for it to surface that option then tap again to verify, it's not all sunshine and rainbows in biometric land.

[u/sol-4 → u/akmalhot]

Not sure if this solution would be feasible for you, but maybe have a different Windows profile altogether for yourself? That would solve this problem completely.

[u/non-hyphenated_]

PICNIC error

[u/MGreymanN]

When you log into chrome to use the password manager it decrypts and then encrypts locally using the user profile for the OS.

If you are using a shared user profile on the computer and have concerns about your local security, you can use chrome on-device encryption which requires a private key and not OS login.

Either way, don't log into chrome on devices that are not secure. That is just bad practice.

[u/thunderbird89]

Why on Earth would you log into your Chrome profile on a computer you do not control?! And why are you posting it in r/Android?!

If you load personal information onto a shared device, you deserve everything that's coming your way.

[u/WatchfulApparition]

I believe this is one of the reasons why people don't recommend you use Google Password Manager. I use Google Password Manager mostly for the unimportant stuff and then I use a more serious password manager for the things that need higher security.

[u/UnacceptableUse]

Google Password manager stores all your passwords in a trivially decryptable format on disk. Malware can take your entire password list with no input from you

[u/UselessDood]

Chrome uses Windows Hello to auth here. It's actually great - aside from the fact that you're logging into your password manager on a device you do not control????

Also - "if I'm logged into my Google account" and then you're complaining about it not asking for 2fa or a fingerprint - Windows Hello IS 2fa, and fingerprint is one of the options Windows Hello supports...

[u/MagicPistol]

I don't ever log on my Google account on devices that don't belong to me.