documentation_complete: true

title: 'Disable Saved Passwords'

description: |-
    Disable by setting <tt>ImportSavedPasswords</tt> to <tt>false</tt> in the Chromium
    policy file.

rationale: |-
    Importing of saved passwords should be disabled as it could lead to
    unencrypted account passwords stored on the system from another browser
    to be viewed.

severity: unknown

identifiers:
    cce: ""

references:
    disa: ""
    nist: ""
    stigid: DTBC0029

ocil_clause: 'it is not disabled'

ocil: |-
    To verify that importing passwords is disabled, run the following command:
    <pre>$ grep ImportSavedPasswords /etc/chromium/policies/managed/*.json</pre>
    The output should contain:
    <pre>"ImportSavedPasswords": false,</pre>
