The horror of trusting Google with your passwords
I'd like to share the story here so that people just stay away from Google's password manager.
I use Bitwarden for all of my important passwords like that of my bank, Google, and Apple accounts.
But for the ones I'm required to sign out every day like Work, I used to save my pwds in Chrome's password manager as it's my default browser.
My company requires changing pwds every 90 days or so. I changed pwds for Citrix and my Company's portal a few weeks ago and saved them in Chrome. And, I've been logging into work using the same until this morning.
Today, I tried to sign into my work as usual, but authentication failed. That's weird, so I thought my 2FA got screwed up. I use WinAuth on my work computer. So, I tried getting codes from Authy installed on my mobile. Still, authentication failed.
So, I go check my pwd in Chrome and to my absolute disbelief, the passwords got changed to old ones. I remember old pwds 'cause they were not that strong and I had easy-to-remember passwords. Only the last time, I picked strong pwds. I also check Citrix, same story. The password got changed.
I immediately reached out to the phone wishing sync somehow failed and I would see my latest pwds, but no.
Luckily, I generated both of these pwds using Bitwarden's password generator and I found out today it saves a history of the most recently generated pwds. And, I was able to get these passwords from there using trial and error. I didn't generate too many pwds recently, so I took only a few tries. Bitwarden saved my ass today.
I felt so dumb for not saving generated pwds then and there in Biwarden. I trusted Google's solution to be reliable. Learned my lesson today. I also plan on keeping my pwds at sync in 2 places. Maybe in iCloud as a backup for Bitwarden.
Always have a backup of your passwords, people.