0

I have just downloaded a Polish program Passtool Password Reader (written by Rafał Jelitto), unpacked it from .rar archive and run it. I have hit the bottom-left button (Pokaż wszystko) and this small piece of software has immediately punched me with all my passwords ever used in Mozilla Firefox and Mozilla Thunderbird. A passwords, that up until now I considered safe, since stored in Password Manager.

My world has just collapsed (or I was that naive). It was that simple? I run that program on my office computer. During my summer break, when my boss has access to my computer (inner regulations), he can do the same and get all my passwords.

What am I missing? How can Mozilla product's creators claim, that their software is safe, if it only require to take four steps and thirty seconds to reveal all passwords stored in it?

  • What did you expect? – curiousguy Jun 9 '15 at 11:05
  • 4
    It works as documented: Even though the Password Manager stores your usernames and passwords on your hard drive in an encrypted format, someone with access to your computer can still see or use them. The Use a Master Password to protect stored logins and passwords article shows you how to prevent this and keep you protected in the event your computer is lost or stolen. – Lie Ryan Jun 9 '15 at 11:25
  • Why this question targets Mozilla? The program website states that it can extract passwords from all major browsers and a few more programs. – el.pescado Sep 19 '15 at 17:17
  • @el.pescado Quite simple... Mozilla was the only program, out of dozens installed on my office computer, where passwords were revealed using this program. Maybe it can extract passwords from all kind or range of programs. Maybe. In my case it extracted them out of Thunderbird only and failed on all other (listed that programs, but did not show any passwords). – trejder Sep 19 '15 at 18:46
9

Have you set a master password? If not you don't even need third party software to view the passwords. Just go to options->security->stored passwords and click show passwords and there they are. Try setting a master password in the security settings and see if the software is still able to list your credentials


Since I can't yet comment on the other answers due to my reputation, the reason why the tool only works for firefox is likly that it's just developed for firefox. There are tools for viewing passwords for other browsers too. Ohter browsers store there data in different locations in different ways. If a software doesn't check these loactions and files it obviously can't display the contents of this files. +the software must know the decryption algorithm for those files.
Mozilla at least gives you the option to set a master password. That is then used for de/encrypting key3.db which contains the key to de/encrypt your stored passwords. With a master password set key3.db can no longer be decrypted with the default key used by those tools and without the key stored in key3.db your stored passwords can't be decrypted as well.

  • In fact, with Firefox it's easiest to deal with this, because with a master password the encrypted file is only decrypted when you enter the password into Firefox, meaning that if Firefox is closed the data's secure. With other browsers (like Chrome), password storage is done through Windows, which means any tool running under your account can access the passwords even if the browser is closed. – cpast Jun 10 '15 at 13:15
3

Understand that passwords must be visible to Firefox itself at least so it can use them in web forms. That means if no other precautions are taken passwords can be discovered. Passwords in Firefox are not safe by default and noone ever said they were. If you want to have your password secure, you have to do some securement first - start with setting a Master password, then you can go further by encrypting your home directory or at least firefox's config.

This is true for any password manager there, not just Firefox. Imagine your password manager as a plaintext file where you put all your passwords line by line. In order to protect these passwords, you'd need to encrypt the file somehow (pgp, aes, whatever) and use some kind of "master" password as a secret key for that cipher. Then, as long as your master password is strong enough and remains secret, so are your other passwords in the password store.

  • Well, I must disagree. I have Chrome, Opera, Internet Explorer and Firefox installed on the same machine. I use password managers in all of them and I don't use master password in any of them. However, mentioned tool managed to extract passwords only from Firefox and failed completely on passwords stored in all three other browsers. So, it seems, that this tiny part isn't "true for any password manager there". – trejder Jun 9 '15 at 12:13
  • 4
    You're obviously missing the point here. "I have a tool that does something" and "the principle of functionality" are not in any way related. The sole fact that you are unable to recover your passwords from your favorite browsers doesn't mean someone else can't. Saying that a tool designed to recover passwords from Firefox can't dig them from Chrome is like saying that my car isn't able to walk my dog. Go google for "chrome password recovery" or something like that, see for yourself. – mikky Jun 9 '15 at 15:34
  • 1
    @trejder The reason you don't need a master password for the other browsers is that they use Windows functionality to supply secure storage. You decrypted it when you signed into your computer, and any program running under your user account can access it. With Mozilla products, it's only decrypted when you enter the master password into the software, and if the software is closed then the passwords aren't vulnerable even if you're logged in (if the software is open and can fill passwords without entering a master password again, it can't be made not vulnerable). – cpast Jun 10 '15 at 13:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.