Security

Protecting your AWS credentials and respecting your privacy are central to how AWS Login Scheduler is built. This page explains what protection the extension provides, and just as importantly, where that protection ends, so you can decide what to trust it with.

Local credential protection

Your AWS password and authenticator secret are encrypted on your own device and protected by a passphrase you choose. Only the encrypted form is saved. Someone who copies your Chrome profile or a backup of your disk finds encrypted data, not your credentials.

When the extension signs you in, it has to use your credentials, so it decrypts them on your device for that purpose and submits them to AWS itself, just as if you had typed them in.

Passphrase and vault access

• Your passphrase protects the credential vault. It must be at least 12 characters.
• The extension does not store your passphrase and does not send it anywhere.
• You unlock the vault with your passphrase when it is required, for example after restarting Chrome. A sign-in that is due while the vault is locked does not start, and the extension tells you why.
• If you forget your passphrase, your saved credentials cannot be recovered. You will need to set up a new vault and enter your AWS credentials again.

Data privacy

Your AWS credentials are not uploaded to us or to any server we operate. The extension has no backend, and nothing is saved to your Google account or synced to your other devices. The only place your credentials go is AWS, when you sign in. The Privacy Policy sets out what is stored and what is transmitted.

Understanding security limitations

Encrypting saved credentials is a real protection, but a limited one. It does not protect you against:

• Malware, or a compromised computer or operating system. Software running under your account can see what you can see.
• Unauthorised access while the vault is unlocked. An unlocked vault on a computer that someone else can use is an open vault.
• A weak, reused or compromised passphrase. Anyone who knows or can guess your passphrase can open the vault.
• Credentials being needed on your device. The extension must be able to use your credentials locally to sign you in, so we do not claim they are unreachable by software already running on your computer.

Recommended security practices

• Use a dedicated IAM user with the least access your work requires. Never use root-account credentials, and avoid administrator access.
• Turn on MFA for the IAM user.
• Choose a strong passphrase that you do not use anywhere else. A few unrelated words are better than a short, complicated one.
• Enable full-disk encryption on your computer, such as FileVault or BitLocker.
• Lock your screen whenever you step away, and lock the vault when you do not need scheduled sign-ins.

Responsible security reporting

If you find a security problem, please report it privately using the contact address on the Privacy Policy page. Please never include a password, an MFA code, a session cookie or a full AWS URL in a report.