Passwords saved in the browser: convenient until the laptop is not yours

Saving a password in the browser feels minor. For one personal forum it is. For a company the same memory holds hosting, the CMS, the ad account and the domain mail. Malware that a person runs together with an "invoice" or an "update" takes exactly that: it does not "break the site", it carries off secrets that were already typed. The later sign-in looks ordinary.

Antivirus covers this poorly, because the file is often run on purpose. A ban on "do not download anything" also works poorly in accounting, where invoices arrive every day. The working replacement is a password manager with its own secret, and a second factor on mail, hosting and ads. The browser can keep the trivia, not the keys to the site.

A short order for the office

• Pull admin and mail passwords out of browsers. Not "someday", the same day.
• Different passwords. One for the site and the ads means a leak of one gives away both.
• A stranger's laptop and the shared reception computer do not keep saved sign-ins.
• When a person leaves, sessions are killed, not only the password on a sticky note.

If you suspect the laptop already gave the passwords away, changing them in the browser does nothing: they have to be changed where you signed in, and the sessions ended. In that case Lexora looks at the admin panels, mail and ads as an incident. If everything is quiet and the news is just frightening, an access audit is enough. The basic site audit is free for new clients, and the list of "who else still remembers the password" is almost always among the first findings.