Firefox played games with me! Its not secure!

I have had this great admiration for firefox and its security. Recommended it to all my friends, family and even enemies (not really, I left enemies with IE). I praised its security to the skies. And now, it has done what I would never have expected it to do. It showed ALL my passwords to a snoopy friend of mine.

All one has to do is:

Go to Tools > Options > Security

In the Security tab, select "Show Passwords".
Then click "show passwords" again.from where you are shown a security dialog box.
*img86.imageshack.us/img86/5931/pic1hj9.jpg

After that,
*img299.imageshack.us/img299/2170/pic2qg3.jpg
There were at least twenty passwords stored, all of which were revealed. I cleaned up my cache now but saved these two just for demo purposes. I used "paint" to darken out the passwords, but its all there! Every password stored in firefox. I mean, what's the point of hiding it with all the asterisks?

My friend said IE is also the same, I didn't bother to check.

I however tried this with my Mac, and I need to enter my keychain password without which I can't get access to any of the stored private information.

oh yeah,you can set a master passwd,isnt firefox2 got that option?

dont use the password manager in firefox

M

yeah this thing is well known in firefox. Only way around I know of is, set a master password.

But the master password is kind of irritating I guess..

L

pathiks said:
dont use the password manager in firefox

You see ^^

I don't believe firefox is the most secure browser on internet. I prefer Opera to use more than firefox.

Andr such prg is GAIM which stores all ur password without encryption!

Damn FF for dis major loophole....

Does opera also has this prob?

Milind check your blog.

Why my blog is fine! Just kidding.

I got your comments if that's what you're hinting at (come to my inbox). Replied as well.

"....I guess its no saving passwords from now on and bank account usage exclusively from the OS X"

nah, i m myself using AI Roboform here with Windows with dual encryption. I once myself tried to crack the encrypted password & it said "29 months .....days remainging to complete"

Check that keypassX. It is for Linux but will work fine in Mac using X11

On the Mac I got my inbuilt Keychain, manages all my passwords with a non-intrusive admin password. And anyway, I don't allow people to use my Mac...

goobimama said:
But the master password is kind of irritating I guess..

Yes and so are the locks but we do use them in our daily lives.

^^ What I'm saying is that if I have to enter a master password every time, then I'd rather not "save password" in the first place.

Yes we do use locks in our daily lives. But sometimes, for convinience sake, we don't "lock it" with the key allowing the door to be opened by anyone. Doesn't mean that everyone should have "the key" to the lock....

goobimama said:
But sometimes, for convinience sake, we don't "lock it" with the key allowing the door to be opened by anyone. Doesn't mean that everyone should have "the key" to the lock....

When someone didn't even have a lock then how can he/she talk about keys? There was an open safe with heaps of money lying in the middle of road. If you call that being convenient then well..ok..

T

just go to tools-> options-> privacy...uncheck "remember passwords". then click on veiw saved passwords...ten click "remove all". its done and it wont save any passwords in future.

why should you use master password every time? You need to use it only when you want to view them. For normal entry, firefox doesn't ask for the master password, does it?

Hey Goobimama, thanks a lot for pointing this out!! I'm clearing out my passwords this second!!

ilugd said:
For normal entry, firefox doesn't ask for the master password, does it?

It does. It asks once every session (afaik). There are extensions that will set "master password time out" for you. This way you can set master password to time out in say xyz secs after which it will be asked again. This enhances the security a notch further.

Aw! That's crap.

If you clear out the passwords, does it still automatically fill the password in web forms for you?

@ eddie: I tried to think about how to counter your argument, but I figured out it is not about Gold, it is about secrets. And what is happening is the perfect analogy to itself.

@Arya: I won't think you have to bother with this mess. Our passwords are perfectly safe in that world without windows or gates...cause firefox uses Keychain on the Mac...

I never use these stuff...but still informative

goobimama said:
@Arya: I won't think you have to bother with this mess. Our passwords are perfectly safe in that world without windows or gates...cause firefox uses Keychain on the Mac...

1. I don't use Firefox.
2. I use Safari.
3. The last thing I am worried about on my Mac is security.

I just wanted to know whether it is possible to have Firefox remember your passwords but not require a master password every time you fill a web form, and not show it to anyone without a master password. Like Safari does it.

Do you know about *www.pimpmysafari.com/, by the way? Install three plug-ins - Saft, PithHelmet and SafariStand. I am sure you'll never want to use Firefox again anyway.

Oh, but you have to use Windows too. (I sympathise with you and can understand the agony!) Is Opera just as insecure?

your arrogance is unmatchable. ;-)

^^ rofl...
btw opera is the best browser on windows....
dunno abt Mac..

ilugd said:
your arrogance is unmatchable.

Isn't it!

LOL! Actually, that is a direct quote from a GMail chat session with goobimama. Only that time, it was he who said it to me.

He was right, of course.

I just wanted to know whether it is possible to have Firefox remember your passwords but not require a master password every time you fill a web form, and not show it to anyone without a master password. Like Safari does it.

off topic

In Windows, if u prefer, then use IE 7. It saves password & without a 3rd party application you cannot see them.

Arya, Firefox if used without a master password will still automatically fill forms etc but it will also show the password easily.

If you want password protection with IE7/Firefox on Windows then use AI Roboform, it's free upto 10 passcards.

If it is used with a master password, will it fill the forms automatically or will it ask for the master password every time?

And no thanks, I am not mental enough (yet) to stray anywhere near 'Interrupter & Exploiter'!

From Firefox Password Flaw Still Open?

Is a flaw in the Firefox browser fixed or not? A security research claims that it's not. Mozilla says it is.

Last November security researcher Robert Chapin discovered a zero day flaw in Mozilla Firefox's password manager. The flaw could potentially allow a maliciously crafted page to auto-fill a form with credentials intended for another site.

Mozilla claimed that it fixed the flaw in its most recent Firefox 2.0.0.2 update. Chapin doesn't quite agree.

Chapin has issued an advisory noting some 22 risks associated with the Mozilla Password manager and that in his estimation, less than 25 percent of the risk represented by these problems has been resolved in the release of version 2.0.0.2.

Still, I use Firefox and sometimes Opera.