The Keys to Everything

A password manager exists to solve one problem: remembering many strong, unique passwords so a person never has to reuse a weak one. It is, properly built and properly used, a genuinely strong defense. The question is what happens when the one thing standing between an intact vault and a fully exposed one — a single master password — has to be typed into a device someone else already has access to.

There is a real architectural distinction here, and it determines whether that defense actually holds. A dedicated password manager — 1Password, Bitwarden, and similar products — encrypts its vault behind a separate master password the operating system session itself never has. Someone using an already-unlocked laptop still cannot see the vault without that second secret. A browser’s own built-in password storage offers no such gate. On a Windows machine, the protection on Chrome’s saved passwords is only as strong as the Windows login itself. Chrome will prompt for the account’s own credential before it displays a saved password — but in a shared household that is the credential a controlling partner most often already has, and it does nothing to stop software running under the logged-in account.¹ Free, publicly distributed utilities exist that will scan every browser installed on a machine and export all locally saved passwords to a file, requiring no hacking skill beyond downloading and running one.² And in a shared household, “physical or remote access to an unlocked computer” is not a hypothetical attacker capability. It is the ordinary daily condition of living with someone.

Even a well-designed password manager has a second point of failure its encryption cannot defend against: the moment the master password itself gets typed. Commercial stalkerware — mSpy, FlexiSPY, sold openly as parental or employee monitoring tools but documented predominantly in intimate-partner surveillance — markets keylogging as a named feature, capturing passwords as they’re entered into any field, master password included.³ This defeats the vault’s protection entirely, regardless of how strong the password is, because the mechanism breaks no encryption. It only needs to be running when the one password unlocking everything else gets typed. A parallel and, if anything, more disturbing tactic is reported in the domestic-abuse technology literature: some abusers are described unlocking a partner’s phone with the partner’s own fingerprint or face while they sleep. A separate, quantified finding on coerced access sits alongside it: a 2024 peer-reviewed study in the British Journal of Social Work, surveying frontline domestic-abuse practitioners, found that ninety-eight percent had worked with clients who experienced some form of technology-based coercive control, and documented the specific tactic of partners forcing or coercing disclosure of device passwords through manipulation or threat — and becoming more abusive when a victim subsequently tried to change those security settings.⁴ If a device unlocks via a sleeping partner’s fingerprint and a password manager app on that device is still authenticated from an earlier session, the vault’s protection was never actually tested. Access was obtained one layer below it entirely.

A different failure mode sits at the vendor level: the 2022 LastPass breach, in which the company initially told users no vaults had been accessed, then disclosed two months later that twenty-five to thirty million encrypted vault backups had, in fact, been stolen. Offline cracking of weak master passwords was later confirmed, and by the end of 2025 investigators had traced more than four hundred thirty-eight million dollars in cryptocurrency theft to this single breach, including a theft from a Ripple co-founder worth about a hundred twelve million dollars when it was taken in January 2024, later valued at roughly a hundred fifty million as the stolen cryptocurrency’s price rose.⁵ It establishes that concentrating credentials in one place creates real concentration risk — but it is a criminal, financial case with no interpersonal-coercive-control dimension of its own. The mechanisms that do connect directly to coercive control are the quieter ones: a keylogger running silently, or a fingerprint pressed to a sleeping face.

Everything a mobile stalkerware keylogger can do, a browser extension can do as well, with meaningfully less friction. The permission “read and change all your data on all websites” is an entirely ordinary, disclosed browser permission — even Google’s own Translate extension requests it, because translating a page requires reading its content. In a malicious extension, the identical permission enables recording every password typed, stealing session cookies to take over an account without ever defeating a password at all, reading or screenshotting any page including banking activity, and logging every URL visited — a complete browsing- history exfiltration. Security researchers have documented more than 3.2 million users exposed to exactly this behavior through tracked malicious extension campaigns,⁶ and the comparison to mobile stalkerware is not flattering to the browser: installing mSpy or FlexiSPY on a phone requires an Accessibility Service permission grant, a distinct and sometimes noticeable step. Installing a browser extension is comparatively frictionless, and the same “read all data” permission a legitimate translator or ad-blocker needs is indistinguishable, at the moment of granting it, from what a surveillance tool needs.

The scale this can reach was demonstrated by DataSpii, documented by the security researcher Sam Jadali in 2019. At least eight browser extensions — tab managers, screenshot tools, and similar ordinary-seeming utilities — harvested the URL, title, and often the embedded hyperlinks of every page their users visited, and sold the aggregated browsing histories through a paid data service marketed, without apparent irony, as “God mode for the Internet.” The confirmed reach extended to as many as four million users, including staff at more than fifty Fortune 500 companies, and for ordinary users exposed tax returns, private photos and videos, and medical information⁷ — a direct, documented instance of exactly the “watch and search history reveals the most sensitive facts of someone’s life” claim this book’s profiling chapter makes in the abstract, here shown actually happening at multi-million-user scale through extensions nobody suspected.

Trust in an already-installed extension does not stay put once granted. It can be undone in at least two distinct ways. The Great Suspender, a hugely popular and long-trusted tab- management extension, was quietly sold to an unknown third party in 2021, which promptly shipped an update adding remote code execution and ad fraud; Google forcibly disabled it for every existing user once this was discovered.⁸ No technical breach was required — only a change of ownership nobody using the extension was informed of. A more alarming mechanism struck the security company Cyberhaven at the end of 2024: a phishing email disguised as a Chrome Web Store policy notice tricked an employee into authorizing a malicious app, giving attackers publishing access to Cyberhaven’s own real, previously trustworthy extension. Attackers pushed a malicious update that exfiltrated cookies and authenticated sessions, and it auto-propagated to roughly four hundred thousand users within the incident window with no install action required from anyone at all — the browser’s own auto-update mechanism did the work. The same campaign compromised more than thirty other extensions, affecting over 2.6 million users combined.⁹

Cloud accounts carry their own version of this same lesson, and its strongest documented anchor involves not a hack but a feature working precisely as designed. Location-sharing and “Find My” services have accumulated the clearest evidentiary record in this chapter, with real convictions attached. Cornell Tech’s Clinic to End Tech Abuse reports that among the fifteen to thirty victims it assists every month, find-my-device apps used as a remote monitoring tool are the single most common issue raised. A National Network to End Domestic Violence survey found that half of victim-service providers report offenders using phone apps to stalk survivors, and forty-one percent specifically report GPS tracking.¹⁰ Callum Henderson, in the UK, was convicted in 2019 of harassing a woman he had met on a dating app by following her movements through Find My iPhone.¹¹ Brooks Laughlin, a Washington state police officer, was convicted of felony stalking and harassment for tracking a former partner through a phone GPS app and video surveillance.¹² A juvenile trafficking victim told investigators her trafficker used Find My iPhone to monitor multiple women being trafficked along a specific stretch of road.¹³ And in one especially severe documented case, spanning a decade of abuse, a man who had taken control of a victim’s Facebook and Apple accounts used Find My iPhone to locate her at a restaurant, took her to a hotel, and sexually assaulted her, filming the attack.¹⁴ Apple’s own product response reads as independent confirmation that the company regards this as a real and serious problem: iOS 16 shipped, in 2022, a feature called Safety Check built specifically to let someone quickly review and cut off everyone they’ve shared location, photos, or account access with, explicitly designed for people leaving an abusive relationship.¹⁵

A related but distinct pattern involves a shared Apple ID or family- sharing arrangement set up, often years earlier, purely for convenience — shared purchases, a shared photo library. Family-law practitioners consistently report that this shared credential grants unrestricted access to most information on both people’s devices, and that access persists after separation unless someone actively unwinds it — surfacing, in practice, as an ex-partner reading messages about the divorce itself, the children’s schedules, or privileged communications with a divorce attorney.¹⁶ It is the identical ownership-model problem examined earlier, one layer up.

The same category of account can fail in two further, distinct ways worth naming precisely. Mat Honan, a Wired senior writer, documented in 2012 how an attacker exploited a gap between Amazon’s and Apple’s account-recovery processes. The attacker convinced Amazon to add a fake credit card over the phone, then used that fake card as “verification” to add a new email address to the account — an email address that Apple then accepted as sufficient to grant iCloud recovery access, no password or technical hack required at any point. Within about an hour, eight years of his Gmail history had been deleted and his iPhone, iPad, and laptop were remotely wiped through the very same Find My feature this chapter has already documented protecting stalking victims — here weaponized instead against the account’s own owner.¹⁷ And in 2014, Apple confirmed that a wave of leaked celebrity photographs, including images of Jennifer Lawrence and more than a hundred others, resulted from a targeted phishing campaign rather than any platform breach: Ryan Collins, sentenced to eighteen months in federal prison, had sent emails impersonating Apple and Google to harvest login credentials from more than a hundred victims and download their full iCloud photo backups.¹⁸ It remains the clearest documented case of cloud-stored personal photographs becoming extortion and reputational-destruction material at scale, with a federal conviction attached.

A final, quieter layer sits beneath all of this, and it comes with an honest caveat. Third-party apps granted scoped API access to a cloud account — through what’s called OAuth — operate on a permission layer technically separate from the account password entirely. Google’s own support documentation confirms that automatic token revocation on a password change is scoped only to mail-related tokens; apps installed through the Workspace Marketplace or built with Apps Script explicitly keep their access even after the password changes.¹⁹ A forgotten backup tool, automation script, or photo-sync utility, set up once years earlier, can retain its full granted access indefinitely, unless someone specifically finds and revokes it in the account’s connected-apps settings — a genuinely different species of the ownership problem this chapter has traced throughout, because this permission was never tied to the password in the first place. Google’s own 2018 review of third-party developer access, launched in the wake of the broader Cambridge Analytica reckoning, tightened exactly this gap for Google Drive, moving from blanket account access to a per-file consent model — the company does not overhaul its developer policy company-wide unless it has concluded the prior model was a real, exploitable risk.²⁰ And Dropbox’s disclosed 2016 breach shows the identical lesson can strike a provider’s own internal systems: an employee’s password, reused from an unrelated breach at a different company, was used to access an internal document containing user email addresses, and the resulting dataset — covering more than sixty million accounts — surfaced for sale on a dark- web forum four years after the original incident.²¹ The honest limit: the technical mechanism here is as solidly documented as any in this book, but no named case of a partner or ex-partner specifically exploiting a forgotten connected app for post-separation surveillance was found in this research. The architecture is proven. The specific interpersonal instance, as of this book’s research, is not.

Pulled back to the whole chapter, though, a copied key never copies cleanly. Account-recovery emails and phone numbers change on a dated log; new-device logins are timestamped; every third-party app still holding access sits listed in a connected-apps panel a person can actually open; location shares can be enumerated and revoked. Apple built Safety Check into iOS 16 for exactly this audit.