How safely use Vivaldi in my work computer?
-
I enjoy using Vivaldi, both for personal purposes and in my workplace. However, I've encountered an issue regarding the storage of passwords on the machine I use at work. When I log out of work, it's crucial that my passwords are not stored on that machine due to obvious security reasons.
In a typical scenario with any other browser, we simply log out of our accounts, and that's sufficient. If desired, we can also clear the browsing history, but usually, the stored passwords are the main concern. However, when I log out of Vivaldi, my passwords are still accessible if someone opens the browser. This poses a significant problem, and despite the appealing qualities of Vivaldi in other aspects, I cannot continue using it due to this serious security issue.
Am I missing something in my usage of Vivaldi? Or could there be a compromise in the browser's security? The only factor I can think of is that my workplace utilizes a proxy that requires a login and passkey for internet access. However, any browser should be capable of operating in such a common situation.
-
@Garashta
Hi, the passwords in Vivaldi are encrypted with your Windows user ID.
If you logout of your Windows account the passwords are save.
Even when somebody can open Vivaldi your Windows user password is needed to read your passwords.
She/he can login to this forum and mess up your reputation.
Nobody should use your Windows account anyway.Cheers, mib
Opensuse Tumbleweed x86_64 KDE 5, Windows 11 Pro, Vivaldi latest
HP Probook Intel(R) i5-8350U 16 GB, GPU UHD 620, SSD 256 GB
Miniforum-B550 AMD Ryzen 7 4700G 16 GB, Radeon Graphics
Xiaomi Mi Note 10 Lite Android 12 -
@Garashta Thank for writing this information.
It is important to me as I also work on shared computers at work.This is related to this request
-
Thank you, @mib3berlin, for your response. That clarifies the security issue.
However, I need to addres that most people do not use the Windows password on a highly personal level, such as when only one person has access, especially in workplaces. It is generally used merely to prevent unauthorized individuals from using the computer.
Therefore, other people in the workplace know the password. The computer does not belong to me or them, and I am not inclined to create another user profile just for myself. It may appear suspicious, paranoid, or entitled, and it would not provide me any benefits other than adapting to Vivaldi's behavior (which could easily be bypassed by using another browser). And what if I don't even want to use a Windows password? I should still be able to prevent a browser with all my passwords from being accessible to anyone who uses it. Every other browser does not present this difficulty.
Having said that, I can conclude that this is definitely a serious problem that should be addressed. It is even expected that users assume Vivaldi behaves like all other browsers, where you simply log out of your browser account and your passwords are not displayed. Therefore, it is a grave error if Vivaldi allows the user's passwords to be accessible to everyone, contrary to what the user reasonably assumed based on the behavior of other browsers.
-
@Garashta
A serious issue is to use private data on a company system.
There is an old feature request for a Master password for Vivaldi. I have many votes but was tagged as "Will not do" from the Vivaldi team.
To my knowledge only Firefox support this.
Maybe you can use a standalone Vivaldi install on a USB stick. It use the Windows ID from this system so password decryption does not work on other systems.https://forum.vivaldi.net/topic/24238/master-password-protected-mode-to-protect-your-profile
Cheers, mib
-
@Garashta said in How safely use Vivaldi in my work computer?:
Every other browser does not present this difficulty.
based on the behavior of other browsers.These are simply falsehoods.
All browsers store the passwords locally. All Chromium-based browsers use the DPAPI for encryption. Firefox has a master password feature, that's the only difference. I don't know what these "other browsers" you're talking about are.
If you don't want Vivaldi to save your passwords, turn off the feature. Then save your passwords in an encrypted KeePass file and protect that with a good password. Save that file on a USB stick. Clear your browser history on close. This isn't rocket science.
-
@Garashta What you're trying to do is essentially self-contradictory: securely preserve personal data in a computer account that's also open to everyone else. A key purpose of Windows 'user accounts' (what you term 'user profiles'?) is to compartmentalize the security of personally-sensitive data on a computer used by more than one person... putting all users of a system in the same account violates that principle and should be avoided wherever specific user privacy is needed. Proper protocol in such situations is to operate the computer with separate user accounts that share in-common access to whatever common tools/software are needed.
As @Pathduck and others have noted, the user password is what all chromium browsers use to encrypt personal data on a Windows computer such as passwords, largely because chromium developers presume users who need to protect their personal data in a Windows system will have their own user accounts - hence their own login passwords which are unique for encryption purposes.
-
Chrome: Click on your profile in the upper right and log off. Now, no passwords will be shown.
Vivaldi: Click on your profile in the upper right and log off. Passwords will still be shown.
Exactly how are those two statements above equal?
-
@Garashta Again, that's not true. Passwords are still there in Chrome, all you're doing is signing out of Google's Sync.
Check the Chrome password manager after signing out.
chrome://password-manager/passwordsJust like in Vivaldi.
-
Just a question :
Many times, I installed Vivaldi portable on a computer at work, in a dedicated folder.
When I moved away, I uninstalled it.
Are my passwords still left somewhere in this computer ? -
@ketalar said in How safely use Vivaldi in my work computer?:
Vivaldi portable on a computer at work
There is not a "portable" Vivaldi.
If you mean Standalone Version see
https://help.vivaldi.com/desktop/install-update/standalone-version-of-vivaldi/So if there is anything left depends on how you "uninstalled it"!
-
@Garashta Everybody (sysadmin, colleague, sharing PC) who can login to your Windows account on your work PC can access your passwords and logins, all browser data.
That is a privacy risk.I think the only way would be to install Vivaldi with Vivaldi Installer option Advanced on a USB stick.
Then the data is only on your USB stick and you can take it with you.
But it could be that you are not allowed to use USB sticks on your work PC by your company IT Security rules. -
@ketalar btw, the risk is very low. Passwords are encrypted with your user credentials but stored within the browser profile and is gone with an uninstall. Usually companies re-image the whole device before giving to someone else
-
You should not store passwords in your browser, not safe. Regardless of the browser. Use a dedicated password manager like KeePass mentioned above.
But then again it's so convenient to use the browser for your credentials. I use it too, for a couple of forums I log in daily, but never on any "important" sites.
