Browser security

Topic

New Reply

I’ve always avoiding enabling Sync on Chrome, Edge and Firefox. I prefer to give Google, MS, etc as little info as possible.

But I am helping someone set up a new computer and syncing would make for much less work setting up the 3 browsers with their favorites, usernames, passwords, extensions, etc.

So my question is do you think that syncing is revealing any more info than they already know, as far as info that is stored in the browsers?

Thanks

Reply | Quote

Replies

Syncing is simply a way to have the individual browser settings from a copy of a browser (Edge, for example) on one computer apply to the same browser on another computer. That way, if you use three different computers, your settings for a given browser (Edge, for example) will be the same on all 3 computers just by setting them up on one computer.

As far as I know, it doesn’t allow settings from one browser (Chrome, for example) to be applied to another browser (Firefox, for example) on the same computer.

1 user thanked author for this post.

Vincenzo

Reply | Quote

Note that by using the browser’s account to sync passwords, means you are depending upon the security provided by the browser. You are storing your passwords in the clouds provided by the browsers, propagating password storage to multiple clouds.

While enjoying the convenience of syncing browser settings, extra steps can be taken to improve one’s security by using compartmentalization. For each browser, the saving of passwords is disabled in browser settings.

Instead of allowing the browser to sync passwords, handle passwords separately, by using an extension from a cloud password/passkey manager to get autofill or autologin across different browsers.

A second compartmentalization is NOT to store passwords tied to financial assets in the cloud at all, to better protect against financial loss. In this case, a non-cloud, local only password manager, would be used for sensitive passwords. You would also have to arrange for backup of the local encrypted password file, protected by a long master password.

Windows 10 22H2 desktops & laptops on Dell, HP, ASUS; No servers, no domain.

1 user thanked author for this post.

Vincenzo

Reply | Quote

windbg wrote:

Instead of allowing the browser to sync passwords, handle passwords separately, by using an extension from a cloud password/passkey manager to get autofill or autologin across different browsers.

Why is that better?

Doesn’t a third-party password manager with browser synchronization involve extra expense?

How does the Microsoft Edge password manager compare with a third-party product?

Reply | Quote

I use Firefox. The only thing I sync is my bookmarks. It would be a lot of trouble to try duplicating the list from scratch across all my devices.
But NO passwords, IDs, of anything else.

1 user thanked author for this post.

Vincenzo

Reply | Quote

PKCano wrote:

I use Firefox. The only thing I sync is my bookmarks

I agree with PKCano.

 

In fact I further  don’t allow any browser to store passwords or ID’s.  I use a dedicated (and hopefully secure) password manager for this.  (Lastpass).  If your computer or device is open, anyone can go into a browser and export your saved passwords…

1 user thanked author for this post.

Vincenzo

Reply | Quote

At least with Firefox, you get choices of what data to sync or remember. Choose what you want.

Besides passwords, addresses and credit cards are NOT synced by me, for privacy and security preferences. Nor do I allow the Firefox browser to store that personal data locally for autofill. But by syncing bookmarks, history, open tabs, add-ons, and settings, I get a more seamless experience when I switch between Windows machines.

Windows 10 22H2 desktops & laptops on Dell, HP, ASUS; No servers, no domain.

Reply | Quote

Much prefer to backup browser settings locally as well as on external isolated backups as a security comforting habit.
Providing voluntary info by syncing to an entities server, isn’t my idea of security (profiling). As ever, YMMV 🙂

Windows - commercial by definition and now function...

2 users thanked author for this post.

wavy, Vincenzo

Reply | Quote

Thanks for the info.

But I am still unable to give my friend a the answer he needs.

If Chrome is already storing some usernames and passwords, it seems to me that Google already has access to that info, but I am not sure if that is the case. So the question becomes, does Google have that access?

Because if they do, then enabling Sync should not be any more of a risk.

Thanks

Reply | Quote

Vincenzo wrote:

If Chrome is already storing some usernames and passwords, it seems to me that Google already has access to that info, but I am not sure if that is the case. So the question becomes, does Google have that access? Because if they do, then enabling Sync should not be any more of a risk.

Hmm… There is a difference between storing your passwords locally with the browser and syncing them to the cloud. The issue is where to store your logon information such as passwords. Check your Google account and Chrome settings. You can tell Google/Chrome not to save any passwords: https://myaccount.google.com/security and chrome://password-manager/settings . Then Google and the Chrome browser won’t remember or store or autofill your passwords. You can choose to save your passwords elsewhere and still sync other browser settings.

Windows 10 22H2 desktops & laptops on Dell, HP, ASUS; No servers, no domain.

Reply | Quote

Vincenzo wrote:

Google already has access to that info

Yes, it does. For example, Google checks the strength of your stored passwords.

Reply | Quote