Firefox played games with me! Its not secure!

[goobimama]

I have had this great admiration for firefox and its security. Recommended it to all my friends, family and even enemies (not really, I left enemies with IE). I praised its security to the skies. And now, it has done what I would never have expected it to do. It showed ALL my passwords to a snoopy friend of mine.

All one has to do is:

Go to Tools > Options > Security

In the Security tab, select "Show Passwords".
Then click "show passwords" again.from where you are shown a security dialog box.
*img86.imageshack.us/img86/5931/pic1hj9.jpg

After that,
*img299.imageshack.us/img299/2170/pic2qg3.jpg
There were at least twenty passwords stored, all of which were revealed. I cleaned up my cache now but saved these two just for demo purposes. I used "paint" to darken out the passwords, but its all there! Every password stored in firefox. I mean, what's the point of hiding it with all the asterisks?

My friend said IE is also the same, I didn't bother to check.

I however tried this with my Mac, and I need to enter my keychain password without which I can't get access to any of the stored private information.

 

[freebird]

oh yeah,you can set a master passwd,isnt firefox2 got that option?

 

[Pathik]

dont use the password manager in firefox

 

[mehulved]

yeah this thing is well known in firefox. Only way around I know of is, set a master password.

 

[goobimama]

But the master password is kind of irritating I guess..

 

[lalam]

dont use the password manager in firefox

You see ^^

 

[deadpulse]

I don't believe firefox is the most secure browser on internet. I prefer Opera to use more than firefox.

 

[Akshay]

Andr such prg is GAIM which stores all ur password without encryption!

Damn FF for dis major loophole....

 

[hemant_mathur]

Does opera also has this prob?

 

[gxsaurav]

Milind check your blog.

 

[goobimama]

Why my blog is fine! Just kidding.

I got your comments if that's what you're hinting at (come to my inbox). Replied as well.

"....I guess its no saving passwords from now on and bank account usage exclusively from the OS X"

 

[gxsaurav]

nah, i m myself using AI Roboform here with Windows with dual encryption. I once myself tried to crack the encrypted password & it said "29 months .....days remainging to complete"

Check that keypassX. It is for Linux but will work fine in Mac using X11

 

[goobimama]

On the Mac I got my inbuilt Keychain, manages all my passwords with a non-intrusive admin password. And anyway, I don't allow people to use my Mac...

 

[eddie]

But the master password is kind of irritating I guess..

Yes and so are the locks but we do use them in our daily lives.

 

[goobimama]

^^ What I'm saying is that if I have to enter a master password every time, then I'd rather not "save password" in the first place.

Yes we do use locks in our daily lives. But sometimes, for convinience sake, we don't "lock it" with the key allowing the door to be opened by anyone. Doesn't mean that everyone should have "the key" to the lock....

 

[eddie]

But sometimes, for convinience sake, we don't "lock it" with the key allowing the door to be opened by anyone. Doesn't mean that everyone should have "the key" to the lock....

When someone didn't even have a lock then how can he/she talk about keys? There was an open safe with heaps of money lying in the middle of road. If you call that being convenient then well..ok..

 

[tech_lover]

just go to tools-> options-> privacy...uncheck "remember passwords". then click on veiw saved passwords...ten click "remove all". its done and it wont save any passwords in future.

 

[ilugd]

why should you use master password every time? You need to use it only when you want to view them. For normal entry, firefox doesn't ask for the master password, does it?

 

[phreak0ut]

Hey Goobimama, thanks a lot for pointing this out!! I'm clearing out my passwords this second!!

 

[eddie]

For normal entry, firefox doesn't ask for the master password, does it?

It does. It asks once every session (afaik). There are extensions that will set "master password time out" for you. This way you can set master password to time out in say xyz secs after which it will be asked again. This enhances the security a notch further.