The average user can make many security mistakes, but leaked passwords aren't their fault. Someone does their job poorly in a service, game, or online application, and the data ends up on strange lists that spread quickly. Using a leaked password poses a direct account hijacking risk for any account, and in an attempt to warn Chrome's millions of users, Google has published an extension called Password Checkup.
The go-to resource for checking whether a username or password has leaked to the web due to a cyberattack is the Have I Been Pwned portal. Its database holds more than six billion credentials, and each one reminds us of a blunt truth: the user is only half the equation. If service and online platform providers don't do their job, they can trigger a computer security crisis overnight.
From there come classic recommendations such as not reusing passwords across multiple sites and adopting a manager with random generation capabilities, so that if a password leaks, it affects only one service and not several (thus minimizing its impact). Google decided to implement a more aggressive strategy when it comes to checking for leaked passwords, and the result is Password Checkup, a Chrome-compatible extension.
How to Check for Leaked Passwords with Password Checkup
In essence, Password Checkup stays silent (with just a new icon next to the address bar) until it detects a username and password combination exposed in a previous data breach. Google's database exceeds four billion items, which it uses to warn users of its services, or in the worst case, apply an emergency "reset" on passwords and ask them to enter a new one.
If the extension finds a positive case, it will present a red alert suggesting an immediate change of the affected password. Users technically have the option to ignore that alert and continue, as well as delete the local information the extension accumulates.
The hypothesis is interesting, but there are two points to highlight. The first is that Password Checkup is a work in progress. I decided to test it with a mix of username and password that was leaked years ago, and the extension gave no warning. The second is that Google obtains an extremely encrypted fraction of credentials, processed via Argon 2 hashing. This is so delicate and complex that Mountain View dedicated an entire blog article to explain its operation, which we can reduce (in very relaxed terms) to three objectives: Google never receives a flat and/or complete copy of the user and password, the system is designed to resist brute-force attempts, and there are no identifiers that allow user tracking.
A positive aspect is that Google didn't work alone on the extension; it joined forces with a team of cryptographers from Stanford University. I'm convinced that several security experts will take apart Password Checkup in the coming weeks. If it gets the green light, it will be a very interesting tool to consider.
Password Checkup for Chrome: Click here
