LastPass/Browser Password Conflict

LastPass/Browser Password Conflict: a reader asks…

I’m a long-time LastPass user but now every browser I use asks me to save passwords and declares that they are secure. This has an advantage on IOS devices because LastPass requires a copy/paste. What is your view on this trend?

I get this request on Chrome all the time, and I wouldn’t be surprised if it shows up on the new Firefox 55.0.3 I just installed. I haven’t bothered to look how to stop them, but I may. What I’m finding is that I start using them because of the convenience between my PC and my IOS devices. I have started mindlessly asking the passwords to be saved when I am running a browser on IOS (but never when I’m on the PC) just so that I don’t have the complications involved with LastPass. I use many browsers, sometimes on purpose and sometimes because I’m taken there (like Gmail pushes to Chrome). I’m sure I have passwords stored all over the place at this point!

When you install a web browser, the default setting is to offer to save passwords. This can be turned off, and probably should be on most browsers, since it can conflict with LastPass. When you upgrade to the latest version of a web browser, it might flip that switch back on even after you’ve shut it off. This can also happen if you use the account syncing capabilities of the web browser.

So for Chrome, if you’re signed into your Google account and add the Chrome browser to a new computer or device, that new computer or device may be setup with Save Passwords turned on, and then the syncing process turns that feature on for all your other computers/devices Chrome installations. The same think can happen with Firefox (signed in), and Safari (using your Apple ID and Keychain). Fortunately, other than when adding a new computer or device, you can turn off the Save Passwords feature on one computer/device, and that will turn it off on all the other computers/devices. Of course, you have to do this separately for each web browser you use (Safari, Chrome, Firefox, Edge, etc.).

I will tell you that for iOS (and my Macbook), I let the Apple Keychain also store my website username/password combinations, in addition to having them stored on LastPass. This just makes it easier on iOS to log into websites, saving the step of calling up LastPass to fill in credentials. While you may have been using the cut-and-paste approach (which you have to for most apps), the Safari web browser (and Chrome and Firefox) on iOS can fill in the credentials faster using the iOS Share link. On a website login page, tap the Share link, then tap the LastPass entry (and unlock it with your fingerprint), then find or tap the entry that has your credentials for that website. That will close the LastPass screen and put you back to the website, but with the credentials filled in for you.

Even though I use the Apple Keychain, I make sure to use LastPass when updating or changing passwords on websites. Once you change a website password, you may have to also update either the Keychain or LastPass – one of them will update easily and one takes a bit more effort. This activity is different depending on what browser and what platform (iOS, MacOS, Windows 10) you are using.

To turn off the Save Passwords feature:

1. In Safari (on iOS) you can turn off from the main Settings app, tap Settings > Safari > Autofill > Names and Passwords and slide the slider off.
2. In Chrome you can turn off from: (On Desktop) ellipsis (3 dots) > Settings > scroll to the bottom > Advanced > Passwords and Forms > Manage Passwords and slide the slider off. (On iOS) ellipsis (3 dots) > Settings > Save Passwords > slide the slider off
3. In Firefox you can turn that off from: (On Desktop) hamburger (three horizontal lines) > Options > Security > and uncheck the Remember Logins for sites checkbox. (on iOS)

If you’re not logged into your Google account (or Firefox account) on all devices, each will have their own settings and changing one won’t change the others. If you use Edge (in Windows 10), you can turn off Save Passwords from ellipsis (3 dots) > Settings > View Advanced Settings > and slide the slider to off for “Offer to Save Passwords”.

Fyi, while I use all the major browsers because I have to (for the work of advising others), I don’t suggest that others do likewise. Rather, choose a primary web browser and then have a secondary one handy. So just two. If your primary (on Mac) is Safari, or if your primary (on Windows 10) is Edge, you can use Chrome, Firefox or Opera as a secondary web browser (setup LastPass on all). If your primary isn’t the built-in default browser (Safari or Edge), then the built-in browser should be your secondary.

Having multiple 3rd party web browsers installed increases your maintenance burden because you have to update all of them. Not keeping them up-to-date risks security vulnerability. So for most folks, I say uninstall any you don’t really need. That means on my Windows boxes I have to have Edge (and IE11) installed, but I set my default browser to Chrome (my personal preference over Firefox). On Macbook I have Safari as the default but have Chrome installed in case I need it. On iOS I generally use Safari, but sometimes Chrome. Of course, with Lastpass enabled on all the web browsers, and I just use the Keychain on iOS Safari for convenience on that platform. On Macbook I still defer to LastPass in either web browser.