0

I have used master password to protect my login information in Firefox. Whenever I first start Firefox and open a page requiring authentication information Firefox asks my master password before filling authentication information to the login page.

I recently opened a page (through a link from another page) that is not a login page nor should need any login information which was weird. Of course I did not provide my master password.

Now this could be some problem in that web page's scripts but it made me think that if it is possible that some website could create a similar popup window to phish my master password?

And if it is possible how could I distinct a phishing popup form the "official" Firefox one?

Of course if the page is not one of my trusted sites and login page I never provide any authorization information.

Improve this question

1 Answer 1

Reset to default
1

If you follow the common security rules and don't use passwords for more than one service/program then what should a website do with your Firefox master password?

This password is only relevant if you have access to the Firefox password database on file-level, therefore for phishing this password it would require access to your file-system. And if someone had come so far I don't think they would require to use phishing in Firefox to get your password. Depending on your OS most likely they can simply sniff it while you type it in the genuine master password dialog of Firefox.

So more likely is that Firefox has detected some (hidden) form that is thinks is dedicated for entering username/password you have saved for the site or one of it's subdomains and therefore it shows the master password input dialog.

Improve this answer
1
  • Good observations.
    – pirho
    Commented Jan 27, 2022 at 9:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .