How does Google know all my passwords?

[ukbf0001]

What you may also want to check - is have your usernames / password being pwned
https://haveibeenpwned.com/

Sites you have been using may have suffered a data breach and your usernames / password being sold on / published. If they are similar in nature - then attempts will be made to hack them. It happened to the Mrs on eBay - she has since been through the bluenun re education program and passed with flying colours

 

[Ian J]

it's good to know that your passwords are weak and you have to change them.

I have just changed all my passwords from "123456789" to "password" so I should be safe now

 

[Naheed Mir]

Google Chrome browser is used by 55 percent of the world's total internet population. Whenever you enter your details on a site, Chrome will ask you to save it or not. When you click on save it, your details are saved. Chrome stores login details like usernames, passwords, and it can be easily retrieved.

 

[paulears]

The Byre’s idea rung bells from my first retail job in the 70s. Every item had its cost price shown in letters. We could do it in our heads really easily. TUNBRIDGES, apparently from a holiday the boss had. T was 1. Totally simple and amazing how quickly it works. I suppose we’d need to modify it to add a punctuation mark or symbol and a number that you could increment when a web site wont let you use an old one.

 

[forevergroup]

Google does indeed offer a password manager that will sync between Chrome installations and mobile devices. For many users this is a blessing, not a curse.

You need to update your perceptions as to what modern security entails and then you may feel a bit better and be less concerned about passwords stored by Google.

You see, the official guidance from Microsoft is that password-based security is inherently useless and needs to be supplemented with other verification methods - MFA and Zero/Device trust.

Here are the truths:

• The advent of Bitcoin mining progressing through GPU acceleration to ASICs has resulted in $25,000 Chinese rigs that can brute-force 100bn passwords a second (!)
• Your passwords can also be compromised by a phishing email or (even more commonly) a third-party breach where a password has been stolen. That problem is compounded if that username/password combination has been re-used in other places.
• In fact, Google have told you that you have 7 breached and 53 re-used passwords already so this is already an issue. Why would you care if your passwords are tucked away nicely on the Google browser in your home when they are clearly floating around on a spreadsheet somewhere available on the internet?
• These passwords are then put up for sale on the Dark Web where they are used on grand and automated scale to attempt compromise of end user accounts. This is called 'password stuffing' and is actually the #1 attack on Microsoft 365 ahead of phishing.
• Implementing MFA is known to reduce password-based breaches by 99.9%.

My recommendation to you is therefore that you accept Google and their applications are likely to be a far safer repository for your passwords than you or the sites you have been using actually are.

However you DO need to ensure that your Google account is protected by MFA so that it does not present a point of vulnerability. Obviously if your Google account is one of the passwords that Google have indicated is breached or re-used then that needs changing, immediately.

Multi-factor-authentication (MFA) - most commonly Two-Factor-Authentication (2FA) involves using another device such as a smartphone app prompt to supplement your password for access to that system. Install the Google app, search for the instructions, and away you go.

You would also do well to search within any other key systems that you make use of and enable MFA/2FA for each and every one of them where available. You've probably noticed your bank and credit card provider (for example) doing this proactively.

If you are concerned about the ability for local devices to be compromised and therefore someone could gain your Google passwords that way using local Windows password credentials, then you need to ensure that your endpoints are encrypted - for example, Bitlocker.

Best of luck.

 

[DontAsk]

• The advent of Bitcoin mining progressing through GPU acceleration to ASICs has resulted in $25,000 Chinese rigs that can brute-force 100bn passwords a second (!)

Citation for that please.

What do you think would happen if you threw 100bn passwords/s at a web site?

 

[forevergroup]

Citation for that please.
What do you think would happen if you threw 100bn passwords/s at a web site?

1. Here you go, it's actually relatively old news that was communicated to the Microsoft partner channel proactively: Your Pa$$word doesn't matter - Microsoft Tech Community

2. Exact outcome would depend on the website, although a broadly irrelevant question.

Of course they don't tend to blast all 100bn in one go to one destination, in the same way that you wouldn't take a Bugatti Chiron down to the local Tescos at 200mph.

The point here is simply to illustrate how easy it is to attack passwords with modern hardware.

Likewise, if your passwords are compromised on the dark web, they only actually need one. Or to try variants thereof.

You'll see in that article, that 20M+ Microsoft accounts are probed daily for password stuffing, and millions are probed daily with 'password spray' (sometimes 100s of thousands broken a day).

Attackers will however use abstraction layers to distribute the traffic to different places via different paths.

For example, after introducing Azure AD Premium to one client we found that an unknown actor in China had attempted (from various IP addresses) to compromise their sales inbox 1700 times.

These attacks were staged from different locations and every five minutes or so to avoid automated detection or enforcement from Microsoft.

As per my email, OP already has 7 known breached passwords and more than 50 incidences of re-use so really this is a classic example of why passwords are not an immaculate protection mechanism for most systems.

MFA/2FA is in most cases free, and it's known to work in many scenarios and cases, so why not get cracking? (excuse the pun)

 

[IWW Limited]

I use a password software called Keeper and ensure I save nothing in a browser.

I always worry if I lost my computer, laptop or even phone I'd be in so much trouble from a) not remembering passwords, b) someone having access to almost everything in my life and c) all my personal emails they would have access to.

I use authenticate app too albeit it's from Google...

 

[forevergroup]

I use a password software called Keeper and ensure I save nothing in a browser.

I always worry if I lost my computer, laptop or even phone I'd be in so much trouble from a) not remembering passwords, b) someone having access to almost everything in my life and c) all my personal emails they would have access to.

I use authenticate app too albeit it's from Google...

It sounds like you've taken a sensible approach. If you're concerned about people gaining access to data on lost devices, then as a final step encryption is your best bet. Bitlocker Full Disk Encryption is free with Windows 10 Pro, and most modern smartphones support encryption also - usually by default.