0

I have just downloaded a Polish program Passtool Password Reader (written by Rafał Jelitto), unpacked it from .rar archive and run it. I have hit the bottom-left button (Pokaż wszystko) and this small piece of software has immediately punched me with all my passwords ever used in Mozilla Firefox and Mozilla Thunderbird. A passwords, that up until now I considered safe, since stored in Password Manager.

My world has just collapsed (or I was that naive). It was that simple? I run that program on my office computer. During my summer break, when my boss has access to my computer (inner regulations), he can do the same and get all my passwords.

What am I missing? How can Mozilla product's creators claim, that their software is safe, if it only require to take four steps and thirty seconds to reveal all passwords stored in it?

Improve this question
4
  • What did you expect?
    – curiousguy
    Jun 9, 2015 at 11:05
  • 5
    It works as documented: Even though the Password Manager stores your usernames and passwords on your hard drive in an encrypted format, someone with access to your computer can still see or use them. The Use a Master Password to protect stored logins and passwords article shows you how to prevent this and keep you protected in the event your computer is lost or stolen.
    – Lie Ryan
    Jun 9, 2015 at 11:25
  • Why this question targets Mozilla? The program website states that it can extract passwords from all major browsers and a few more programs.
    – el.pescado - нет войне
    Sep 19, 2015 at 17:17
  • @el.pescado Quite simple... Mozilla was the only program, out of dozens installed on my office computer, where passwords were revealed using this program. Maybe it can extract passwords from all kind or range of programs. Maybe. In my case it extracted them out of Thunderbird only and failed on all other (listed that programs, but did not show any passwords).
    – trejder
    Sep 19, 2015 at 18:46

2 Answers 2

Reset to default
10

Have you set a master password? If not you don't even need third party software to view the passwords. Just go to options->security->stored passwords and click show passwords and there they are. Try setting a master password in the security settings and see if the software is still able to list your credentials

Since I can't yet comment on the other answers due to my reputation, the reason why the tool only works for firefox is likly that it's just developed for firefox. There are tools for viewing passwords for other browsers too. Ohter browsers store there data in different locations in different ways. If a software doesn't check these loactions and files it obviously can't display the contents of this files. +the software must know the decryption algorithm for those files.
Mozilla at least gives you the option to set a master password. That is then used for de/encrypting key3.db which contains the key to de/encrypt your stored passwords. With a master password set key3.db can no longer be decrypted with the default key used by those tools and without the key stored in key3.db your stored passwords can't be decrypted as well.

Improve this answer
1
  • 1
    In fact, with Firefox it's easiest to deal with this, because with a master password the encrypted file is only decrypted when you enter the password into Firefox, meaning that if Firefox is closed the data's secure. With other browsers (like Chrome), password storage is done through Windows, which means any tool running under your account can access the passwords even if the browser is closed.
    – cpast
    Jun 10, 2015 at 13:15
3

Understand that passwords must be visible to Firefox itself at least so it can use them in web forms. That means if no other precautions are taken passwords can be discovered. Passwords in Firefox are not safe by default and noone ever said they were. If you want to have your password secure, you have to do some securement first - start with setting a Master password, then you can go further by encrypting your home directory or at least firefox's config.

This is true for any password manager there, not just Firefox. Imagine your password manager as a plaintext file where you put all your passwords line by line. In order to protect these passwords, you'd need to encrypt the file somehow (pgp, aes, whatever) and use some kind of "master" password as a secret key for that cipher. Then, as long as your master password is strong enough and remains secret, so are your other passwords in the password store.

Improve this answer
3
  • Well, I must disagree. I have Chrome, Opera, Internet Explorer and Firefox installed on the same machine. I use password managers in all of them and I don't use master password in any of them. However, mentioned tool managed to extract passwords only from Firefox and failed completely on passwords stored in all three other browsers. So, it seems, that this tiny part isn't "true for any password manager there".
    – trejder
    Jun 9, 2015 at 12:13
  • 5
    You're obviously missing the point here. "I have a tool that does something" and "the principle of functionality" are not in any way related. The sole fact that you are unable to recover your passwords from your favorite browsers doesn't mean someone else can't. Saying that a tool designed to recover passwords from Firefox can't dig them from Chrome is like saying that my car isn't able to walk my dog. Go google for "chrome password recovery" or something like that, see for yourself.
    – jficz
    Jun 9, 2015 at 15:34
  • 2
    @trejder The reason you don't need a master password for the other browsers is that they use Windows functionality to supply secure storage. You decrypted it when you signed into your computer, and any program running under your user account can access it. With Mozilla products, it's only decrypted when you enter the master password into the software, and if the software is closed then the passwords aren't vulnerable even if you're logged in (if the software is open and can fill passwords without entering a master password again, it can't be made not vulnerable).
    – cpast
    Jun 10, 2015 at 13:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .