Google wants Chrome users to avoid ‘boring’ security problems with new extension

Google needs you to trust the internet to stay successful.

Google on Tuesday introduced a new browser extension that will alert users when they’re relying on a compromised username and password combination.

The plug-in, called Password Checkup, warns Google Chrome users when they enter credentials that previously have been exposed by hacks into non-Google websites. The tool compares the user’s anonymized credentials with a database of names and passwords stolen in prior data breaches, then warns them that re-using the same information on multiple sites makes them especially vulnerable to hackers.

The plan resembles ongoing security awareness tools like Have I Been Pwned, the free website where visitors can check if their email address was caught in a breach. Mozilla has added a feature to its Firefox web browser that uses Have I Been Pwned’s information to warn users when they visit a website that recently experienced a data breach.

Password Checkup is the latest effort from Google to help unwitting users understand when other websites are putting their information at risk, said Emily Schechter, a product manager on Chrome’s security team. Password Checkup is distinct from existing tools like Security Checkup, which allows Google users to check if their accounts are vulnerable; Chrome’s password generator; the Titan security key; and the various Google Cloud offerings announced last year.

“The most boring-sounding issues still create the most problems for users,” Schechter said. “The Chrome extension is coming from the philosophy that we want to help people when they’re not on Google products.”

Attempted cyberattacks against Dunkin’ Donuts and HSBC bank, for example, were made possible in part because so many customers re-used their credentials.

Google also used Chrome to spread its Safe Browsing initiative, which uses a bright red security warning to alert users when they are visiting a website that fails to protect user connections with SSL encryption. The number of encrypted web pages climbed to 77 percent of the web in 2018, up from 67 percent the year before, according to the SSL advocacy group Let’s Encrypt.

“I don’t want people to need to know what SSL is or to need to know what a secure password is to stay secure online,” she said. “We can’t fault people for using software in ways that make sense for them. We need companies to make products in ways that actually work for people.”

Security researchers at Chrome now are conducting research to better understand how closely internet users read the URL in their browser bar. If users don’t try to decipher web addresses, that presents an opportunity for scammers who can redirect them to a website that looks legitimate but in fact is designed to steal their information, Schechter said.

“If people are using Chrome and all their data can be intercepted from a public cafe, that’s not good for the internet itself,” she said. “And if people don’t feel fundamentally safe using the internet, that wouldn’t be good for Google.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure