I use 32-character (128-bit) randomly generated passwords. It's a little bit hard to remember them all, so I use encrypted keyring built into firefox. In this way I have different passwords to different sites. Moreover, if a domain changes, the event will be visible because I won't be able to use the stored credentials. In order to log in, I use only one device. Its HDDs are also encrypted (FDE). I'm using linux, and also I have separate firefox profiles, each of which is protected by AppArmor (different profiles). I think it's a really secure setup.
Usually when you want to log in to a web service, you just type your login and password and Firefox asks whether you want it to remember the credentials so in the future you won't have to type them manually again. For some reason admins try to prevent from taking this action. One way to achieve that is to use
autocomplete="off" in the form. I've managed to bypass this by using the
saved-password-editor Firefox addon. It was working so far. Two days ago I encountered a site where this solution simply doesn't work. The problem is that the page has some hidden fields. It looks like this:
<!-- fake fields are a workaround for chrome autofill getting the wrong fields --> <input style="display:none" type="text" name="fakeusernameremembered"/> <input style="display:none" type="password" name="fakepasswordremembered" value="fakevaluetopreventpasswordremeber" /> <input type="password" id="password" autocomplete="off" name="password" tabindex="2" placeholder="Hasło"/> <input style="display:none" type="password" name="anotherfakepasswordremembered" />
The result is that I can't use the stored login/pass. Firefox simply doesn't fill the form. So the question is: how to force Firefox to fill this kind of forms?