Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

In the old days I would emphasize that people should not select the remember passwords option because (besides the fact you tend to forget what the browser remembers) a bad guy could could display the password (if he knew how) and read it there, and then use it later.

These days the passwords can be encrypted using a master password, so the primary problem is gone.

So should I use the feature?

On the good side, it helps prevent phishing because it checks the domain name automatically.

Also, am I just imagining, or does it also make the attacker's job more difficult? (simple key-loggers are insufficient unless the Firefox data files are fetched as well)

Then on the bad side, if someone walked up to your computer just after you logged in to a gaming site, then they could probably pull up your banking password as your master password would still be in memory, would it not?

Either way, more in-depth attacks are equally capable of obtaining data regardless of which route you took?

  • Can you provide some guidance on how to decide whether to use the option, from a security standpoint?
share|improve this question
    
It is also worth considering some other issues that you didn't raise, such as: if passwords are stored in the browser, what about: usability (for example, what about passwords for non-web purposes?) availability (for example, what if you switch to a different browser, machine, or Firefox profile?) In other words, even if the browser provides sufficient security, is this a good place to store your passwords? –  jdigital Jan 6 at 22:28
    
Short answer: I'd say it's mostly for ease of use, and it enables you to use much more unique passwords since you don't need to remember all passwords (be sure to backup Firefox' password database though!). I'd recommend using the master password and storing most passwords (not your bank login perhaps, but most sites should be no problem). –  Luc Feb 6 at 13:45

3 Answers 3

You have been very thorough in considering downsides and benefits.

Using master password in Firefox or other browser is usually acceptable compromise. Nevertheless, there is no care free approach for dealing with passwords. (Convenience vs. security.)

Earlier question How secure are my passwords in the hands of Firefox using a Master Password? gives some guidance it says: most likely secure, but I would not use.

My advice is opposite: if you cannot remember a lot of hard to remember passwords or passphrases, using browser to remember (and in some cases generate) your passwords can be a good compromise.

As far as banking goes: many banks use two factor authentication (such as ID, password + number from single use password list). I don't use banks/brokers/etc. which allow using them with just ID+password, as such authentication info get leaked too easily.

Anyway, if there are high security passwords, I would memorize them in my head.

Key logger

In case of key logger, master password does not fully protect against them, because key logger will then record master pass.

Passwords in your head

If you can remember unique password for each site you use, each password having very large amount of entropy, it is better than remembered passwords (except against key logger).

However, in practice, there is so many site passwords that it is almost impossible to pick very good passwords for each one of them.

Using key store

Key store allows you to use master password to store a lot of passwords. Instead of many good passwords, you need only one good password. This password is supposedly easier to remember as it is often needed. Because of less passwords to remember people afford to use more complex password as master password.

Synchronized passwords

Some applications like Firefox (and Safari and so on) allow you to synchronize your passwords between your devices. Such service is very convenient. Because the synchronization often goes through quite a few servers, all those who can see the traffic may try recovering your passwords. At least the parties who are able to break your master pass most likely get access to all your passwords.

share|improve this answer
1  
"In case of key logger, master password does not really protect against them, because key logger will then record master pass." What I meant was, it prevents the real password from getting leaked to the keylogger. The master password is not useful on its own unless the data files are captured. Granted, the keylogger could also get the data files, and everything else. Just speaking of simple keyloggers. –  George Bailey Jan 6 at 23:55
    
@GeorgeBailey: The wording was bad. I've fixed wording with s/really/fully/, without explaining further. However, sad fact is: whoever is able to get key logger to your device, the same party is likely to also get the data files, and thus acquire all passwords for price of one. –  user4982 Jan 7 at 6:46

A Firefox Master Password was a good feature introduced, it helps save time for typing every password on every website, as you pointed. There are data files to obtain that password, your saved passwords are encrypted with them.

In answer to your question about the password being in memory, it will stay in memory until you restart your firefox AFAIK, but, if someone tries to access your saved passwords even if it's already in memory, you would be prompted again as you can test, as far as accessing websites, yes, it would still give access if you have saved credentials in them, although there's no way in retrieving any passwords without the master password, that's why it was implemented.

Although it's a good feature, Personally i would recommend using LastPass.

It's a widely-known manager for storing and keeping your passwords "more secure", it has also plugins for different browsers including Firefox that i use. It also has generating "random-secured" passwords with different options and number of characters you'd like. In my opinion that's the safest way you can protect your passwords, and it's easy to setup. It has many features including one to scan your passwords and display how secure are they in a score board between 0 and 100, depending on multiple factors, and suggests how you can improve them.

As long as you protect your password for that site or use the other possible ways of authentication that it provides, including Fingerprint and Card Reader authentication, you must have reader devices of-course.

share|improve this answer

It's a trade-off. You defend against phishing attacks, but you lose against physical or software attackers.

Just be aware that Firefox comes with everything the attacker needs. You must remain vigilant about the physical security of your computer.

For a simple proof, go to any login prompt with a saved password field. I'd recommend looking at your bookmarks, and trying to find one named "My Bank". Click the username field, then pick the top listed entry. The password should auto-fill with asterisks or dots. Right click on the password and pick "Inspect Element". In the inspector window, locate the type="password" attribute, highlight it, then hit delete. Press enter, and the password is revealed in the browser.

Just remember, if your computer isn't locked, any high school kid can probably do this.

share|improve this answer
    
Please limit the answer to items that change between Remembering Passwords With Master Password and Entering The Password Manually Each Time. –  George Bailey Jan 6 at 23:58
    
"lose against physical or software attackers" I don't see how this relates. Where does it become easier to attack when I use encrypted password memory? "simple spoof...saved password field" That wouldn't work on Master Password Protected memory. –  George Bailey Jan 7 at 0:00
    
Physical access to Firefox, once youve entered the master password, allows unrestricted access to your saved passwords, regardless whether you use encryption or not. –  John Deters Jan 7 at 0:24

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.