Navigating Google's password system is a frustrating and confusing experience. More on reddit.com

Apparently, they're telling the truth. On principle, for PCs with Windows: If a program (in this case, Chrome) can auto-fill a password without asking you for a Master Password, then it means the information to decrypt your password file will most likely be available to malware because it can just get the password the same way the program does. The password vault is probably permanently unlocked for this functionality to work. This seems to be the case for Chrome. According to the article referenced by the author of the software mentioned in the video, Chrome stores the password decryption key in a file that can be easily read by the current user and, as such, malware can read it too. Additionally, Google has a Password Manager . I can't use it because I have a Sync Password, but you may want to check what information is available to anyone who has access to your Google account. 2FA codes can also be synced to both Microsoft and Google accounts, which may also be a problem, since these accounts can be accessed by using session cookies stolen by malware. Cookies are also stored along browser data with no security. If a program asks for authentication or a Master Password every time (or very often) in order to auto-fill a password, then the program may be correctly protecting the password vault. In this scenario, the security relies on the actual implementation of the feature, as the vault key must be correctly discarded after use. In this scenario, a malware piece can still "wait" for an unlock event and copy the retrieved password or master password. This means that requiring a master password repeatedly may not provide any additional security against a piece of malware that can run for enough time, survive and capture an unlock event. For example: if you're typing your master password every hour, then the malware only needs to run for one hour to capture the master password and the vault. If unlock events are extremely rare - say you only unlock your password vault once every week - then the malware code may actually be challenged by an anti-virus software before it can capture the password from the unlock event. Having the vault permanently unlocked won't help though, so it means the vault has to be locked the whole time. Both Chrome and Edge have options to request a Windows Hello unlock every time a password should be filled. This is a good example of "you'll be relying on the implementation to be secure." I have no idea if these options actually make the system more secure against malware. My guess is no. Third-party browser extensions from password managers are known targets for malware. TL;DR Google auto-fill apparently provides no tangible security, but password managers may not improve the situation too much. Some actual mitigation strategies I can think of: Password vault unlock events should happen in a secure environment that malware code cannot tamper with. This requires some sort of virtualization or sand-boxing that is more common in mobile applications than desktops. Windows also has the Secure Desktop feature, and 1Password apparently has or had this feature . Is it still there or relevant? I'm not sure. Each password request should only retrieve a single password. As long as the malware is unable to retrieve the master password (for example, because it is being used in a secure environment), then only the passwords you used -- and not your whole vault -- would be stolen. This minimizes the consequences of the compromise. Windows Hello logins are tied to your device because the PIN is tied to your device. Although sessions can be stolen, there may be mitigation strategies available to service providers, and your password will be safe so the attacker may be limited in what they can do with that session, also limiting the consequences of the compromise. Given technical limitations and how hard it is for us to know when password managers are doing the right thing, one strategy you could use would be to strictly use a password manager on your phone and manually type the passwords as you need them, or use different password managers / vaults for different types of passwords so you don't have to unlock valuable vaults too often. On phones, password managers are their own applications with private data storage; as long as a malicious app can't root your device, the password vault should remain secure. This also means saving passwords on a different platform (such as Chrome on Android) will be different than Chrome on Windows or Linux. More on reddit.com

Are you gonna mention which password manager you use or do we have to guess? More on reddit.com

Best Password Managers & Comparison Table I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns. More on reddit.com