Are Password Manager Browser Extensions Unsafe?
According to a Verizon cybersecurity report, in the last decade, one third of all documented data breaches involved the use of stolen passwords. That’s a bleak statistic, and even though cybersecurity awareness has been gaining some ground, there’s still a long way to go.
Password managers are an excellent way to keep all your credentials organized, however they may also present an easy gateway for hackers to access your information. Studies have shown that password manager browser extensions may pose dangerous security risks due to vulnerabilities like excessive permissions, script injection, and data tracking.
Considering this, maybe we should think twice before blindly installing them and stick to dedicated password manager apps instead. Plenty of platforms have highly intuitive and easy to use apps, like LastPass.
Why people use password manager browser extensions
Nowadays, people value convenience over almost anything else, and that also applies to managing credentials. Password managers include browser extensions to make navigating the web a better experience, allowing you to log in quickly with autofill. In addition, you don’t need to copy-paste usernames, emails, and passwords each time you’re logging in.
These browser extensions also help save credentials more easily, only requiring you to log in the first time. Still, the use of extensions isn’t limited to this, as they often provide shortcuts to other tools like password generators or password health indicators.
Free password manager with LastPass
Become a LastPass Free user and take advantage of its enormous scope of password management features.
Use LastPass for Free
Are password manager browser extensions safe?
Password manager browser extensions are generally considered safe, but they’re not foolproof and can leave you exposed. Most of the risks associated with browser extensions stem from excessive permissions, cross-site scripting attacks, browser vulnerabilities, lack of updates, and phishing.
For example, you might unknowingly use a password manager’s browser extension autofill feature on a fake login page designed by hackers to capture your information. Another concern is that browser extensions usually request permissions to interact with websites, including accessing data stored in the browser, such as cookies. Hackers can take advantage of this to hijack sessions, giving them access to your accounts.
Additionally, most browsers load third-party scripts when you navigate the web, which can interfere with password manager extensions. For instance, if you’re navigating a web page that loads an ad script from an untrusted source, it could potentially access the password field and any information autofilled by browser extensions.
Browser extension exploitations
Numerous incidents and research studies can attest all these security issues:
- Bitwarden browser extension exploit: In 2023, the security provider Flashpoint found a way to exploit Bitwarden’s browser extension. Any website with embedded external iframes containing login forms from different domains would be autofilled without iframe origin verification. This could be easily exploited if any bad actor injected a malicious iframe on a trustworthy website.
- Avira Password Manager browser extensions vulnerability: In 2022, it was found that the browser extension’s autofill feature would be triggered when visiting fake login web pages. Subsequently, the attackers were able to access the inputted info via JavaScript.
- “Cookie Monster” exploit: In 2021, a security flaw was detected in several browser extensions, including those of password managers. This flaw was named “Cookie Monster,” as it worked by exploiting users’ session cookies to attackers. Malicious websites would easily access authentication cookies, hijacking active sessions without requiring login credentials.
Password manager apps: a safer alternative
In order to guarantee the best security possible, we recommend going for password managers with designated apps, such as LastPass. Apps can ensure a much better security standard since they don’t operate within a browser’s ecosystem. This reduces exposure to specific browser-based vulnerabilities like compromised third-party extensions, malicious scripts, and poor encryption.
Plus, most password managers let users set up MFA, including one-time passwords, hardware security keys (e.g. Yubikey), app-based authentication, and biometric logins.
LastPass app first look
LastPass app interface
LastPass app import
Encryption and offline access
Password manager apps are also kept in a controlled environment, separate from the browsers. For example, using zero knowledge architecture, many popular password managers encrypt data on the user’s device before syncing it to cloud servers. This is a much safer alternative to browser-based encryption processes, which can be easily exposed to the network.
Furthermore, some apps allow users to access their vaults offline, which significantly reduces the odds of being hacked. Alongside this, offline access provides the convenience of having uninterrupted access to confidential information no matter the circumstance.
Key factors when choosing a password manager app
Choosing a password manager might be overwhelming, especially given the number of solutions available. Fortunately, we have a few key factors to make the process easier for you:
1
Choose a service that employs at least AES-256 encryption or equivalent, such as LastPass. This military-grade encryption combines speed and strength and is certified by the U.S. National Institute of Standards and Technology.
2
Consider how the password manager stores your data. While most save it in external servers in the cloud, the safest experience is achieved with locally stored data.
3
Factor in multi-device compatibility. This feature only reaches its full potential if it syncs automatically across devices, saving you time and the hassle of dealing with inconsistent data.
Practical tips for staying secure with any password manager
Most password managers include strict encryption methods and security features, but there are extra measures you can take to bolster your online safety.
1
Keep your password manager always up to date. Some password managers have auto-update, which should always be enabled. Updates usually comprise of security refinements that make the app less likely to be breached.
2
Use a strong master password and enable MFA. A strong master, passphrase, or even two master passwords are crucial to securing vaults. After all, it’s the first entry point for all your credentials. Additionally, make sure to set up additional authentication methods, such as OTP, PIN, biometrics, push authentication, and others.
3
Check exceptional permissions given to password managers to access data. These services often won’t fully work without them, but it’s still important to regularly inspect what permissions are being granted. If you find any permission that seems out of place or suspicious, disable it immediately.
Conclusion
Password managers are excellent for keeping all your data safe in one vault, but like any other software, there’s always a downside. Browser extensions offered by these services present significant security risks with excessive permissions, script injection, and phishing.
Choosing designated password management apps instead of browser extensions is a much safer bet when it comes to warding off potential hacks. They offer a higher level of security with strong encryption, MFA options, and occasionally offline access.
We recommend switching to a dedicated password manager app like LastPass to maximize your security and password management experience. While it features a browser extension, it also has apps for the most popular operating systems. Plus, it has a free version, free trials, and discounts for you to enjoy. To know more about this password management solution, check out our in-depth review.
Sérgio F.
Mary P.
User feedback