Password leak alert does not trigger for compromised stored credentials
0 reputation · 10 Feb 2023, 23:01 UTC
Goal
Ensure that Chrome’s Password Manager surfaces a leak alert whenever a stored credential matches an entry in its breach database.
Constraints
The alert relies on a regularly updated breach feed, operates only when the native password manager is enabled, and is limited by the OS‑level encryption that protects the credential store.
Uncertainty
It is not documented how often background checks run, nor whether all credential formats (including Unicode passphrases) are consistently matched against the leak list.
What is the expected frequency of automatic leak checks?
How does Chrome handle credentials that contain non‑ASCII characters?
Under what conditions might a compromised password fail to trigger the alert?