1

While at the login screen for my Google account, I pulled up my password manager and began entering my master passphrase, so that I can retrieve my password for the login. However, while I was looking at the keyboard and typing the master password, I must have accidentally tapped my touchpad, bringing the Google login into focus. As a result, I had typed the entire master into the Google page, though none of my keystrokes registered as dots in the "Password" field.

I am now concerned that the login page may have still captured my keystrokes and that Google may have my master password, which I also use to encrypt files.

Should I change the master? Or am I being too paranoid?

user311982
  • 155
  • 3
  • 3
    Are you equally worried about Microsoft having it, because they could intercept the keystrokes when you open your password manager? In theory, they could have logged it, but until you posted here, it would be a string without context - they'd have no way to tell if it was a password for another account, random typing, a sentence you were meaning to enter elsewhere... It wouldn't be a bad idea to change your password though, because you suggest you use the same one for two distinct uses. Wouldn't be worried about Google though. – Matthew May 16 '17 at 15:17
  • 1
    If you have a HP Notebooks with the special Audio Driver you have now a textfile with your password in it. But every keystroke is there registered ;) – Serverfrog May 16 '17 at 15:33

2 Answers2

2

If you are asking the question "Is my password compromised" then you suspect compromise and should change the password immediately, as per NCSC advice. Don't second guess if the risk is high enough; just do it. (This habit is the price you pay for not having to rotate it every month, like the advice used to be.)

I actually did this exact thing the other day. Very irritating as it so happened I'd changed my pw the previous week!

Graham Hill
  • 15,594
  • 38
  • 63
0

If you were on google's main website then no I would not be worried. They have too many visitors and if they are keylogging all of them then the world has bigger issues.

If you were on an unknown or malicious phishing website then maybe perhaps I'd be worried.

With all that said though it's so very easy to just change your master passphrase any time you feel uneasy about a password situation so this might be one of those times where you just change it anyways so you stop worrying.

neonprimetime security
  • 986
  • 5
  • 17