Mozilla admits Firefox is flawed just like IE

In a public mea culpa, Mozilla Corp.'s chief security officer acknowledged today that Firefox includes the same flaw that the company called a "critical vulnerability" in Internet Explorer during a two-week ruckus over responsibility for a Windows zero-day bug.

We thought this was just a problem with IE," Synder continued. "It turns out, it is a problem with Firefox as well."

*www.computerworld.com.sg/ShowPage.aspx?pagetype=2&articleid=5857&pubid=3&tab=Home&issueid=115

If you go by the no of vulnerabilities discovered, FF is as insecure as IE.

ok so now shld i change back to IE...coz my sys does not hav much RAM ??
shall i switch back to IE ??

Password vulnerability in Firefox 2.0.0.5

more reasons just out:
Password vulnerability in Firefox 2.0.0.5

According to a message posted over the weekend on the Full-Disclosure mailing list, the latest version of Firefox, 2.0.0.5, contains a password management vulnerability that can allow malicious Web sites to steal user passwords. If you have JavaScript enabled and allow Firefox to remember your passwords, you are at risk from this flaw.

The Mozilla team fixed a similar flaw last November, one which did not require JavaScript. The heise Security Web site contains a demo/proof of concept of the vulnerability risk that you can use to determine your vulnerability.
The original flaw was referred to as reverse cross-site scripting and was reportedly widely used on Myspace.com.
Note: A reader has pointed out that MySpace.com does not allow Javascript, as originally reported. The reader is correct, although there do seem to be workarounds which result in Javascript executing on some browsers.
Discussions between heise Security and Mozilla developers describe a debate among Mozilla developers over removing this feature, since "evil" server pages can steal passwords from browsers whether the user has opted for password management by Firefox or not.
Apple's Safari is vulnerable in the same way. Current workarounds include disabling JavaScript in Firefox or avoiding the use of Firefox password management on sites where users are allowed to post JavaScript pages.

*www.linux.com/feature/118166

aks_win said:
ok so now shld i change back to IE...coz my sys does not hav much RAM ??
shall i switch back to IE ??

hmmm.... do i see an opera neophyte in the making??!

so nobody tried to know the impact of this vulnerability/?
*www.heise-security.co.uk/services/browsercheck/demos/moz/pass1.shtml
^ur passwds stored on FF can be stolen already!!

Soo...firefox sux for storing passwords. Thanx god I have AIRoboform in Windows.

Or keychain in Mac OS with 1Passwd

Or <enter name here> in Linux

I never store passwords in browsers.

@Prakash I will continue here itself.

What kind of encryption does IE , FF and Opera use for storing passwords?

aks_win u r the man.. This is the right time 4 u to try opera..

{Linux rants- sry if u dnt get}
@charangk,@linuxuser:
I am yet to use a password manager in Debian/Ubuntu.I hope Gnome-keyring-manager,Gpass etc for Gnome or similar for Kde like kwallet helps. or search synaptic for passwd manager

infra_red_dude said:
hmmm.... do i see an opera neophyte in the making??!

not really...why should i use firefox when it $ucks...(sadly now its bad)
i use it only because efficient adblocking
now i think its available with all browsers

1 thing i liked in firefox is bookmark toolbar !! hope i get this in opera now.
am goin to try using IE 7 and opera now

praka123 said:
so nobody tried to know the impact of this vulnerability/?
*www.heise-security.co.uk/services/browsercheck/demos/moz/pass1.shtml
^ur passwds stored on FF can be stolen already!!

^^This problem is fixed now

very bad news.

cyberboy_kerala said:
^^This problem is fixed now

It aint.as with Ubuntu(2.0.0.5)

Opera rocks..........

Firefox is the rats. Even though I use it I despise it. The only reason I sort of promote it, is cause IE is the rodent and there's nothing worse than using IE.

goobimama said:
Firefox is the rats. Even though I use it I despise it. The only reason I sort of promote it, is cause IE is the rodent and there's nothing worse than using IE.

IE 7's engine is old, that is true. But I guess somebody never used IE 7 "software" on Windows, which in few things beats Firefox

(Page zoom, better speed of the software part)

Of course there must be somebody who hasn't used IE software on Windows. But not me. I've tried IE 7 thinking that it would make for installing less software (I don't like lots of apps), but sadly, I don't like it one bit. There's also the thing of the "Stop" button separated from the "back forward" buttons. It stretches out to the other side on my 1920*1200 widescreen. Horrible. Gone back to Firefox. Waiting for safari to show some signs of stability (in Windows) and then make the switch.

no browser is FLAWLESS but i still feels Firefox is BETTER than internet explorer and opera

I will suggest Opera anytime over firefox. I personaly use Maxthon 2.0 which is basically running on IE7 engine . Smooth experience with no problems.

goobimama said:
Of course there must be somebody who hasn't used IE software on Windows. But not me. I've tried IE 7 thinking that it would make for installing less software (I don't like lots of apps), but sadly, I don't like it one bit. There's also the thing of the "Stop" button separated from the "back forward" buttons. It stretches out to the other side on my 1920*1200 widescreen. Horrible. Gone back to Firefox. Waiting for safari to show some signs of stability (in Windows) and then make the switch.

I had to use IE7 coz the megaupload toolbar wouldnt work firefox.

so far Oːera?

praka123 said:
It aint.as with Ubuntu(2.0.0.5)

oops..now the password is showing here also..first time it didn't showed up..but this only works if the page is in the same server isn't??....not much problem for me i think.

Firefox is still the best browser for customization other browsers are soo boring after using firefox.

pannaguma said:
I had to use IE7 coz the megaupload toolbar wouldnt work firefox.

I believe there is (still) a reg hack which makes megauplod work without the crap toolbar. I had used it long time ago and it worked flawlessly.

Another thing , there is something for FF too which makes megasuckload work without the toolbar , just google for stuff .