Nope.
Just don't use Chrome. That's an even better solution.
Let me teach you a neat trick (I'll use firefox as an example, but this can be done in any browser because it's a "feature" of HTML).
>Open firefox and navigate to a login page where your password is saved
>Right click on password box and click inspect element
>In the console, change type="password" to type=""
>Move your eyes back to the password field
Oh dear, what's this?!
Protip: Don't store your passwords in your browsers if you let other people use your computer. End of story.
In Firefox you can go to preferences, security, and saved passwords. And News Flash: If you leave your wallet unattended for 30 seconds, someone could take your money. I guess wallet makers should include a warning too?
Incorrect if you set a master password, which Firefox allows you to do and is the reason why everyone's saying 'wtf, chrome?' and leaving firefox alone.
As for the dumb ones, they're storing their passwords on a sticky-post. Or using Chrome.
Also, just because some people will be able to access the passwords with physical access doesn't mean it's not worth doing basic/unsecure locking. I'd rather use a system where people need to have the know how to use keyloggers in order to break, over one where Joe Schmoe can walk in and take everything.
In the end I have always known the security issues with saving passwords so I don't save any banking passwords or email account passwords in any browser.
And what's a better way to make it clear than actually showing the passwords ?
Read this: https://en.wikipedia.org/wiki/Principle_of_least_astonishmen...
Then tell me what's better:
- Asking users to store password, and having a menu hidden in the guts of Chrome's settings that most users will never look at.
OR
- Asking users to store password, and prompting them at the same time that doing so is insecure.
Keeping in mind that the vast majority of users of this software are average, non-techies.
If you don't want people browsing your passwords, you can't ever give them access to your user account or your unlocked desktop. That's it, that is the entire solution. Any other method of protecting the passwords is vulnerable as long as the potential attacker has physical access to the unlocked desktop.
Now, perhaps some of this is mitigated by the fact that most of those friends, coworkers, significant others won't know how to install a keylogger or install extensions - but some small percentage will anyway, and those users who were lulled into a false sense of security will have been just as exploited anyway.