3

Firefox stores passwords (I am not referring to the Master Password feature) and I would like to know if a survey website can steal those passwords.

I was typing a URL and perhaps I mistyped it and ended up on a strange website that wanted the user to take a survey for a prize. It showed a dialog (floating on top of the regular Firefox currently active tab) in the middle of the screen saying something to the effect that as an "FB user I am invited to take a social networking survey". I am not an FB user so this was obviously a malicious website. The dialog wording was confusing so that a user intent on declining the offer would click on buttons that seemed to invoke another dialog that had a button to lead back to the first dialog. It wasn't possible to just exit the dialog on the first try. Once the dialog is exited, the browser tab itself was not exitable. I answered about 3 questions before I was able to close the browser tab. (I think the questions were: your gender? how many social networking sites do you use? your age?).

The survey was in the form of perhaps one command button to start the survey and then "auto-enter" radio buttons for the 3 questions. The survey was presented in the normal part of a Firefox browser, not a dialog floating on top. Both the regular Firefox tab and the dialog appeared to use a fairly standard looking motif for Ubuntu/Firefox (I don't know where appearance settings are grabbed from: OS, app, or combination) but I am not completely sure since Ubuntu with the Gnome desktop to my eye does not look as distinctive and harder/hardish to fake as, say Windows 7. In other words, I think the dialog appeared to be implemented in a standard way, but obviously it was not fully standard in that you could not exit it. The browser tab I am less certain about because graphics can be made to deceive.

Concurrent with this browser tab, I was signed on to gmail and stackoverflow.

I am on Firefox 3.6.20 and Ubuntu 10.10.

|improve this question|||||
  • (With sufficient rep - 75 points) you can set a bounty on a question (to encourage answers) but not on the act of physical harm to another person (or on any other action outside of stackexchange, for that matter) :-) – Misha Sep 1 '11 at 6:57
  • 2
    Broiyan, questions about the operation of the site such as whether bounties are available should be asked over at meta.security.stackexchange.com. – user185 Sep 1 '11 at 9:41
4

So the way that saved passwords work is that the password you store is associated with a specific domain where you've manually entered the password, and then chosen to save it for future use.

So, if I choose to save a password for https://login.example.com, and that's the only password I've ever saved, it's not going to auto-populate on any domain or protocol other than https://login.example.com. Not for http://login.example.com (unsecured) or https://www.example.com, and certainly not for some random malicious domain that is attempting to emulate the UI of the genuine login in an attempt to trick you into entering your credentials.

There is the potential for attacks if malicious users can figure out how to inject form fields into pages that are served by a domain where you've chosen to save credentials, and I believe there was an in-the-wild exploit based on this approach on MySpace a few years ago, but I'm not aware of any currently know risk to saved passwords from malicious third-party domains.

|improve this answer|||||
-2

I don't think so. I think your passwords are safe.

|improve this answer|||||
  • 2
    While this may or may not be technically accurate, the answer really needs a bit more meat to it. – Iszi Sep 15 '11 at 18:48
  • @Iszi, I don't have anything more to add. I don't recommend judging answers by their length; that's a pretty crude metric. As far as I can tell, this is a yes/no question, with a simple answer. But if you have more you can add that you think would be helpful to broiyan, by all means, please add your own answer or feel free to edit mine -- additions are welcome. – D.W. Sep 16 '11 at 1:41
  • 3
    I don't have enough knowledge of Firefox's inner workings to add detail, but a proper answer should include specifics as to exactly how the passwords are protected against the perceived threat posed in the question. One shouldn't be expected base a decision regarding passwords for any accounts on information from someone who can only say "I don't think [they can be compromised in that manner]. I think your passwords are safe." but they may more reasonably follow the advice of one who can say "No, they are not at risk from this threat, and here is why." – Iszi Sep 16 '11 at 2:12
  • 2
    One may also reasonably be expected to accept advisement which says "Yes, this threat is real and here is a high-level explanation of how your passwords might be exposed by it." but cannot really glean much use from an answer which just says "Yeah, I think the site might be able to somehow steal your passwords". Perhaps that would instill an added level of (appropriate) paranoia, but it doesn't really offer enough intelligence to be actionable. – Iszi Sep 16 '11 at 2:18
  • I will take part of DW, this question is so personated that it does not belong here.. therefore a qualified statement would be perfectly enough. Though, it can always open up a discussion of "Who are you, making such statement?". – Independent Nov 8 '11 at 19:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.