Firefox stores passwords (I am not referring to the Master Password feature) and I would like to know if a survey website can steal those passwords.
I was typing a URL and perhaps I mistyped it and ended up on a strange website that wanted the user to take a survey for a prize. It showed a dialog (floating on top of the regular Firefox currently active tab) in the middle of the screen saying something to the effect that as an "FB user I am invited to take a social networking survey". I am not an FB user so this was obviously a malicious website. The dialog wording was confusing so that a user intent on declining the offer would click on buttons that seemed to invoke another dialog that had a button to lead back to the first dialog. It wasn't possible to just exit the dialog on the first try. Once the dialog is exited, the browser tab itself was not exitable. I answered about 3 questions before I was able to close the browser tab. (I think the questions were: your gender? how many social networking sites do you use? your age?).
The survey was in the form of perhaps one command button to start the survey and then "auto-enter" radio buttons for the 3 questions. The survey was presented in the normal part of a Firefox browser, not a dialog floating on top. Both the regular Firefox tab and the dialog appeared to use a fairly standard looking motif for Ubuntu/Firefox (I don't know where appearance settings are grabbed from: OS, app, or combination) but I am not completely sure since Ubuntu with the Gnome desktop to my eye does not look as distinctive and harder/hardish to fake as, say Windows 7. In other words, I think the dialog appeared to be implemented in a standard way, but obviously it was not fully standard in that you could not exit it. The browser tab I am less certain about because graphics can be made to deceive.
Concurrent with this browser tab, I was signed on to gmail and stackoverflow.
I am on Firefox 3.6.20 and Ubuntu 10.10.