My thoughts as an enterprise Java developer.

Wednesday, April 04, 2012

Is it more secure to allow the browser to save a website password or prohibit it?

Is it more secure to allow the browser to save a website password or prohibit the browser from saving the password?

Benefits of allow the browser to save the password:
  1. Spoof websites are more easily detected because the username and password don't show up (this may be a mute point if the username is saved but not the password).
  2. Keyloggers won't pick up the password if you don't type it. (Thanks to Thrawn)
  3. People will be less likely to keep the password in an obvious place (i.e. sticky note)
Benefits of prohibiting the browser from saving the password:
  1. Stops someone with access to your computer from accessing the passwords (the level of access needed can vary based on how the passwords are stored).

No comments: