top of page
tioreemavelkingna

How Google Chrome’s Password Checkup Extension Enhances Your Online Security



The password checkup feature, first released as a Chrome extension in February, cross references user passwords with the 4 billion username and password combos that Google said it knows have been breached.


On the web, Password Checkup will be available at passwords.google.com. If Chrome users ever choose to use a Google account with the Chrome browser and then saved passwords in Chrome, this is the website where those passwords are synced to.




How Google Chrome’s Password Checkup Extension Works



The passwords.google.com website has been around for a while but has only been known to Chrome power users. But starting today, Google wants all Chrome users to consider it the company's official "password manager."


The Password Checkup feature is based on an eponymously named Chrome extension that Google launched in February, which allowed users to test their locally saved Chrome passwords for any leaked credentials.


Early in 2019, Google introduced Password Checkup to warn of breached third-party logins. Originally a Chrome extension, the tool was integrated into its online password manager and later the browser itself. Next month, Google will sunset the dedicated Password Checkup Chrome extension.


In October of last year, Password Checkup was integrated with the Google Account Password Manager, which also warns about reuse and weak credentials. Visiting passwords.google.com lets you run the tool, while Chrome 78 integrated the remaining, at sign-in extension functionality directly.


Google's password checking feature has slowly been spreading across the Google ecosystem this past year. It started as the "Password Checkup" extension for desktop versions of Chrome, which would audit individual passwords when you entered them, and several months later it was integrated into every Google account as an on-demand audit you can run on all your saved passwords. Now, instead of a Chrome extension, Password Checkup is being integrated into the desktop and mobile versions of Chrome 79.


On February 5th, for Safer Internet Day, our team launched its first public-facing system, called Password Checkup. Password checkup allows users to check, in a privacy-preserving manner, whether their username and password matches one of the more than 4B+ credentials exposed by third-party data breaches of which Google is aware. This launch success vastly exceeded our wildest expectations, with over 650,000 users installing our chrome extension in the first three weeks following the release.


Accounts which are exposed via data breach are 11.6 times more likely to be compromised, in part because many Internet users reuse the same credentials on multiple sites. Password Checkup help users mitigate this threat through a one-click, install and forget Chrome extension that warns them at login time if the username/password used for that site was publicly exposed in a breach (as shown above).


Besides allowing us to check that Password Checkup behaves correctly in the wild, the most important lesson we have learned from the telemetry so far is that we must add to the extension an in-page form detection. This is because some popular sites, mainly in China, hash the password on the client side in javascript before sending it, which causes the extension not to work in those cases. This is a very important finding, that we are actively investigating, as some of the largest data breaches mostly affect Chinese users and are actively weaponized by cyber-criminals.


The answer is yes! Of the 6M credentials checked every week, 85k of them are detected as compromised (1.8%) and users reset about 25% of those. Moreover, 94% of the new passwords are as strong or stronger than the compromised one, as can be seen in the chart above. It shows the strength of the compromised password and the strength of the new password, according to Password Checkup anonymous telemetry that reports the strength scores given by the strength meter embedded in the extension (zxcvbn) upon password change.


OneLogin, a unified access management vendor, today introduced Shield, a browser extension intended to fight password reuse, weak password practices and phishing. The software is available in both free and enterprise plans and through Google Chrome browser.


Shield is a browser extension available through Google Chrome; it works with any existing identity provider and offers users a free or enterprise plan. The enterprise version of Shield offers more functionalities such as the ability to alert administrators or suspend user accounts if the software identifies threats and the ability to export intelligence to security information and event management tools for further reporting and analysis.


Google offers its own password protection extensions called Password Alert and Password Checkup. Password Alert notifies users if they enter their Google Account password into any site other than Google's sign-in page. However, it does not protect passwords for non-Google services. The Password Checkup extension promises to help users resecure accounts affected by data breaches. According to Google, the extension alerts users if they enter a username and password that is no longer safe because it appears in a data breach known to the company.


Google announced security enhancements for Chrome this morning, including a built-in password checkup (previously was just an installable extension), as well as comprehensive phishing protections.


How secure are your passwords? You probably know that you should create strong passwords and never re-use them across different websites and services. If you store passwords in Chrome on the desktop you may know that your browser has a password checkup tool built in. Google has now added the Password Checkup tool to Android as well.


The Password Checkup is designed to keep you safe by comparing your stored passwords against an online database of known data breaches and exposed passwords. Whenever you enter or save a password, it tests your entry and if a match is found, your phone will show you a warning and advise you to change the password. You can also manually review all your stored passwords and perform a password checkup as well.


Google is celebrating Safer Internet Day with two updates to protect user data, including your priceless usernames and passwords. One of them is a neat extension for the desktop version of Chrome, the other is called Cross Account Protection.


Password Checkup was an extension for Chrome that offered users better control and protection over their passwords. Since many people use the same password for multiple services, having it exposed can cause lots of trouble.


Password Checkup, as the extension is called, sits in your browser waiting for you to log into any website. If it detects that your username and password combination are unsafe, due to their appearance on some internet data dumping ground, it will tell you that you should change the password.


Not to be outdone, Google also recently launched a new data breach service through their Chrome Password Checkup browser extension, which when installed would alert users if their user names and passwords were compromised when they log into a site.


Through the use of the Password Checkup extension, Google conducted a study that estimates 1.5% of all logins have been compromised in data breaches. This study also showed that 26% of users who were shown a data breach notification, changed their password.


The requirement to stay logged into your Google Account is, frankly, troubling because the extension should not need you to be logged in to verify your password against a database of leaked passwords.


It works like this: if Google detects that a username and password on a site you use is one of over 4 billion credentials that Google knows are compromised, the extension will warn you and suggest that you change your password.


The researchers (which also included one from Stanford University) came to their conclusions from Google Chrome's Password Checkup extension, which securely checks passwords saved in Chrome with more than 4 billion unsafe username and password combinations that were at some point caught up in a breach.


This is how the extension works. When you are about to log into an online service, it takes the username and password entered in the login form and checks them against a database of 4 billion credentials that Google engineers have collected from public breaches.


Keep in mind that Google-stored passwords are only as secure as the devices you're using. If your device has been corrupted by malware, there's a chance your master password (and by extension all of your passwords) could be pilfered. This risk is not unique to Google's password manager, however, as all password managers are vulnerable to this type of intrusion.


Armed with this info, the Chocolate Factory directed its software engineers, in conjunction with crypto boffins from Stanford University, to create a Chrome browser extension called Password Checkup that allows Chrome users to check to see whether their passwords can be found online.


Mozilla's rival browser Firefox implemented a similar service last year called Firefox Monitor that checks a third-party database of exposed credentials called HaveIBeenPwned.com. Users of password management app 1Password also have access to an extension that checks stored credentials against exposed ones using the same service.


It is not clear to me whether the extension is actually using your password to make the determination, or if it is merely reporting to you that the particular site you are logging into has been the subject of a data breach, or perhaps only checking your username.


Password Checkup was built with privacy in mind. It never reports any identifying information about your accounts, passwords, or device. We do report anonymous information about the number of lookups that surface an unsafe credential, whether an alert leads to a password change, and the domain involved for improving site coverage. You can learn more about how Password Checkup works at =password-checkup. 2ff7e9595c


0 views0 comments

Recent Posts

See All

Comments


bottom of page