Should I let VPN control my laptop’s password?

[AMSOS]

I’m using Nord VPN on my phone and laptop. While selecting or changing a server on my laptop, a window pops up to ask my computer login password.

It gives me the option of permanently giving it permission, or to give this every time I login/change servers.

I don’t feel comfortable giving Nord control over my network connections by giving it permanent access to my password. Do any of you do this? Could there be any security issues? Am I better off letting the VPN have automatic control?

Thanks!

 

[poked]

I personally wouldn’t let a VPN do anything, but if you want the privacy, sure. Look up on Google what those permissions are required for and decide for yourself:

NordVPN users’ passwords exposed in mass credential-stuffing attacks

Many of the dumps have been pulled off public webpages, but at least one remains.

arstechnica.com

This is from 2019, so they may have beefed up security, but I prefer not to let anything store my passwords. If I can’t remember, I reset them so they’re secured again anyway.

 

[gilby101]

a window pops up to ask my computer login password.

Can you show us the popup.

At a guess (may be wrong), it wants your computer password because 1) the NordVPN app has asked macOS for your NordVPN password which is stored in your keychain and so 2) macOS has asked you for your password before giving NordVPN app your NordVPN password.

 

[AMSOS]

I personally wouldn’t let a VPN do anything, but if you want the privacy, sure. Look up on Google what those permissions are required for and decide for yourself:

NordVPN users’ passwords exposed in mass credential-stuffing attacks

Many of the dumps have been pulled off public webpages, but at least one remains.

arstechnica.com

This is from 2019, so they may have beefed up security, but I prefer not to let anything store my passwords. If I can’t remember, I reset them so they’re secured again anyway.

Oh, thanks for pointing this out to me. Sometimes, I wonder if we're all being taken for a ride by these companies.

 

[AMSOS]

Can you show us the popup.

At a guess (may be wrong), it wants your computer password because 1) the NordVPN app has asked macOS for your NordVPN password which is stored in your keychain and so 2) macOS has asked you for your password before giving NordVPN app your NordVPN password.

Sure. Here is a screenshot of what I see when shifting servers.
Let me know what you think!

 

[gilby101]

Here is a screenshot of what I see when shifting servers.

That fits with my guess. It is macOS asking if you want NordLynx process to get stuff out of your keychain and it is being precise about what stuff - the NordVPN entry in your keychain. If you trust NordVPN (I assume you do as you are using their VPN product), then no problems. You can use Keychain Access to inspect the NordVPN in keychain. It could be a password (as I suggested before) or a certificate.

 

[AMSOS]

That fits with my guess. It is macOS asking if you want NordLynx process to get stuff out of your keychain and it is being precise about what stuff - the NordVPN entry in your keychain. If you trust NordVPN (I assume you do as you are using their VPN product), then no problems. You can use Keychain Access to inspect the NordVPN in keychain. It could be a password (as I suggested before) or a certificate.

Oh, I see. That sounds fine.
Just to clarify, let me ask you--is there any way Nord VPN could get hold of my computer's password? Or, any way in which it could potentially gain control over major parts of my machine?
I mean, it's clear that all traffic is being routed through Nord. They are the conduit, so to that extent they are in control of what is going out.
But is there a way in which they could potentially be able to see non internet related stuff on my computer?
Thanks!

 

[lostom]

Oh, I see. That sounds fine.
Just to clarify, let me ask you--is there any way Nord VPN could get hold of my computer's password? Or, any way in which it could potentially gain control over major parts of my machine?
I mean, it's clear that all traffic is being routed through Nord. They are the conduit, so to that extent they are in control of what is going out.
But is there a way in which they could potentially be able to see non internet related stuff on my computer?
Thanks!

NO, NordVPN can't get your password for your comp.
MacOS doesn't allow it, Nord wouldn't have that permission.
I think this (link) is what you are seeing.

What is Keychain?

Keychain Access is the macOS built-in password management app. It stores your passwords and account information so you have fewer passwords to remember and manage. Keychain Access offers to rememb...

support.nordvpn.com

You ask "potentially", maybe though highly unlikely I would suggest, I have been wrong before though.

 

[AMSOS]

Thanks, this helps!
I went ahead and set it to "allow allow."
Well, hopefully things will be fine. At this point, having to put in my computer password everytime Nord wants access to its password is tiring.