Change the default lock option from "Never" to...anything else?

[kriswilk]

By default the Chrome extension is set to NEVER lock the vault. This is, IMHO, a tremendously dangerous default setting for the average user. Many users may not realize that their vault is unlocked even after closing the browser...any passer-by could just open the browser and have everything.

Furthermore, this default setting means that the master password (or some valuable hash of it) must be persistently stored on the computer rather than just temporarily in memory. I realize this must be the case for the "never" setting, but as the DEFAULT?

I propose:

• change the default lock option to, say, 15 minutes. This would be way more sane and users could always change it consciously afterward.
• if you DO change the coded default, notify users when the extension is updated and ask if they want to change their current setting to the new default. This will alert anyone who was not aware of this already.
• always alert users to the additional security implications of selecting "Never" as the lock setting...some kind of popup message maybe?

[kspearrin]

Default is set to "On Restart" starting with 1.24.0 (next release).

[kriswilk]

Thanks for changing this default. As noted in #485, this issue is a good place to discuss the right UI warning for users who venture to choose "never" as the lock option. I'd say, something like:

WARNING: The 'never' lock setting provides convenience but stores your master password persistently on disk. For improved security, consider changing your lock option to any other value.

[nogweii]

For users like myself who haven't changed from the default of Never, when you do select a different option, does it clear the master password from disk?

[kriswilk]

Based on the discussion and information from issue #485, it's possible that the master password might linger on disk for some time before being flushed.

If you want to be on the safe side, either change your master password, or at least uninstall and reinstall the extension. I believe that would remove the files on disk that might potentially contain the cached password.

[kspearrin]

This is resolved in the next version.

When a user chooses the "Never" option they are now presented with this warning:

If you change from "Never" back to any other value the extension's storage is reseeded so that the lingering log file is properly cleaned up.

[peterrus]

I just installed the extension for the first time ever on a Firefox installation (extension version: 1.41.0) and 'Never' was the default. Is this expected behaviour?

[kspearrin]

@peterrus No, the default should be "On Restart"

[peterrus]

I just checked it again on a clean install and I can't reproduce this. I'll just chalk it up to a mistake on my side!

Apologies for the noise!

[enricovolpato]

I don't want to open a new issue for this, but I think the default option should be for the extension to either lock after a certain amount of time (I think it's 1 hour on the desktop app) or on system lock. I think putting one's computer to sleep without exiting the browser is normal behaviour nowadays, and therefore this issue is still dangerous.