Chrome security/privacy questions

[Buntu Bunny]

This morning I read "Memo from 2008: Chrome stores passwords in plain text (*gasp*)" over at Ubuntucat. The title obviously caught my attention in light of what recently happened here at the Ubuntu Forums. Even with some question as to the authenticity of this claim, I nonetheless went to take a look at my Chrome settings. I looked at "manage saved passwords."

Mostly those passwords are for Gmail and various Blogger blogs, and in fact, blogging at Google is about the only thing I use Chrome for anymore. Because of Google's tracking policies, I have Google Disconnect enabled on Firefox, but Disconnect causes Google Blogs to display improperly, so I leave Disconnect disabled on Chrome and use it for blog visiting only. If there's a workaround for this, I'd love to know and ditch Chrome altogether.

Also, in Chrome settings, would it cause problems to uncheck "Continue running background apps when Google Chrome is closed" under system settings?

Lastly, is Chromium more secure than Chrome in regards to how it handles passwords?

[Frogs Hair]

I use Iron which has the same settings as Chromium and Chrome. Iron has to be updated manually because there is no tracking . Iron has the sign in option, but option is the key word . I have never saved passwords in any browser so I'm used to a little extra work.

Also, in Chrome settings, would it cause problems to uncheck "Continue running background apps when Google Chrome is closed" under system settings?

I have always disabled this option since discovering it without noticing any difference at all.

[Buntu Bunny]

I use Iron which has the same settings as Chromium and Chrome.

Thanks Frogs Hair. I installed Iron and honestly can't tell much difference from Chrome

Iron has to be updated manually because there is no tracking.

How do I update it manually? Something like sudo apt-get update Iron && sudo apt-get upgrade Iron?

I have always disabled this option since discovering it without noticing any difference at all.

Again, thank you.

[Hungry Man]

I wouldn't use Iron.
http://www.insanitybit.com/2012/06/2...-to-chrome-21/

[CharlesA]

I wouldn't use Iron.
http://www.insanitybit.com/2012/06/2...-to-chrome-21/

Totally. Owned.

[Mr.Dunham]

The title obviously caught my attention in light of what recently happened here at the Ubuntu Forums.

Well, the key here is that we should get used to take care of our sensitive stuff like passwords and other personal/private information always, as a healthy habit, not because of some forum being hacked.

I have never saved passwords in any browser so I'm used to a little extra work.

Same here. One of the first things I always do is to uncheck the "Save passwords" option on any browser, here in my own Xubuntu system and also in the several ******* computers I use at my workplace. To me it's just common sense. Anyone is entitled to handle this stuff the way they want, just be aware that always there's extra work to be done; if you uncheck the save password option, you'll have to type them in again; and if you check the "save" option, you'll need to take an extra care.

[vasa1]

I wouldn't use Iron.
http://www.insanitybit.com/2012/06/2...-to-chrome-21/

+1.

Iron has to be updated manually because there is no tracking.

doesn't make sense to me. What about other software that doesn't need to be "updated manually"? All spyware?

Anyway, using Iron doesn't eliminate the password issue that OP has.

[CharlesA]

Also any browser that can autofill passwords stores them in the clear, even Firefox with a master password. The difference is that if you haven't entered in that MP yet they're encrypted - but once you do they aren't. There's further validation with MP but an attacker with physical access can dump the memory of any user they have access to so yeah, it'll keep your friends out, but that's all.

I suggest using Chrome with LastPass.

Agreed. I use KeePass myself, but LastPass is good to.

Same here. One of the first things I always do is to uncheck the "Save passwords" option on any browser, here in my own Xubuntu system and also in the several ******* computers I use at my workplace. To me it's just common sense. Anyone is entitled to handle this stuff the way they want, just be aware that always there's extra work to be done; if you uncheck the save password option, you'll have to type them in again; and if you check the "save" option, you'll need to take an extra care.

I think I only use the save password thing for one site and it is because I use a certain browser only for that site due to some issues it has with FF and Chrome.

[Buntu Bunny]

.... I use a certain browser only for that site due to some issues it has with FF and Chrome.

Well, this is the problem that prompted me to ask the question in the first place; I need a browser only for reading Google's Blogger blogs, because if I disable Google tracking then the blogs are not rendered properly. I use FF for everything else. I like Opera but it's slow on my system, even in turbo.

I appreciate all the comments. I took a look at KeePass yesterday, and I'll look at it again today.

[Hungry Man]

Also any browser that can autofill passwords stores them in the clear, even Firefox with a master password. The difference is that if you haven't entered in that MP yet they're encrypted - but once you do they aren't. There's further validation with MP but an attacker with physical access can dump the memory of any user they have access to so yeah, it'll keep your friends out, but that's all.

I suggest using Chrome with LastPass.