In the old days I would emphasize that people should not select the remember passwords option because (besides the fact you tend to forget what the browser remembers) a bad guy could could display the password (if he knew how) and read it there, and then use it later.
These days the passwords can be encrypted using a master password, so the primary problem is gone.
So should I use the feature?
On the good side, it helps prevent phishing because it checks the domain name automatically.
Also, am I just imagining, or does it also make the attacker's job more difficult? (simple key-loggers are insufficient unless the Firefox data files are fetched as well)
Then on the bad side, if someone walked up to your computer just after you logged in to a gaming site, then they could probably pull up your banking password as your master password would still be in memory, would it not?
Either way, more in-depth attacks are equally capable of obtaining data regardless of which route you took?
- Can you provide some guidance on how to decide whether to use the option, from a security standpoint?