Slashdot Mirror
Password Vulnerability In Firefox 2.0.0.5
Paris The Pirate writes "According to a message posted over the weekend on the Full-Disclosure mailing list, the latest version of Firefox, 2.0.0.5, contains a password management vulnerability that can allow malicious Web sites to steal user passwords. If you have JavaScript enabled and allow Firefox to remember your passwords, you are at risk from this flaw."
I haven't RTFA (after all, this is Slashdot), but are all OSes equally vulnerable?
Three days ago: http://it.slashdot.org/article.pl?sid=07/07/20/125 2215
Eh. Depends on what passwords you set it to remember. There are a ton of BS passwords that I don't give a damn if someone steals.
Like anywhere else, you need to make a trade off between usability and security. Sure, it's not perfectly secure, but it's not worth it to me to have to remember the one off junk password I made up for NYTimes.com.
The real issue, as usual, is javascript. I use "NoScript" and am careful about which sites I allow to execute scripts at all. That will do more for your security than anything else.
ad logicam Claiming a proposition is false because it was presented as the conclusion of a fallacious argument.
All the truly intelligent people use Lynx.
Ben Hocking
Need a professional organizer?
Ben Hocking
Need a professional organizer?
NoScript
Repeat ad nauseum.
Trolling is a art,
And this is why I save all of my passwords in IE
This is why we need something better that text passwords for authentication on the web. Most people can't remember all the passwords they use on every site they go to. To cope with this, Average Users do either one of two things - use the password remembering method in their browser of choice or use the same (weak) password for everything. Granted, there are some decent password management utilities out there, but your Average User would rather use a tool they already have.
How may I help you today?
Passwords are not in plain text, but readable with Firefox.
You can set master password to truely encrypt them. But if you let people to access your harddrive, you can install keyloggers to steal the master password also. Or any password, no matter do you save it or not.
telnet is for weenies.
netcat is for men.
Very funny you jerk! You steal my password, then mock me on my slashdot account! Is there an admin around? -The Real Normal Dan
Firefox's password file has never been in plain text, although if you don't specify a master password, the decryption key is stored in the same directory, so the encryption will only stop casual opportunists.
This isn't theft, it's liberation! Information (including passwords) wants to be free!
"Ask not what your country can do for you." --John F. Kennedy
i just attach the cables to my nipples and decode the packets manually.
I knew Post It Notes were more secure!
-- "So they told me that using the download page to download something was not something they anticipated." - Bill Gates
Who modded the parent post "Insightful", and why? It is a one line blanket statement cast against millions of people without discussion or foundation. I hope someone takes away your mod points.
If you use many websites that require you to log in you don't have many options. You could use one password for all of them, in which case a breach on one account by an attacker essentially breaches all other accounts that they discover, or you can use unique passwords on each site, in which case it soon becomes impossible to remember them all accurately - especially for sites that you don't use very often. Additionally, some sites have rules around the number of upper case characters, special characters, digits, etc. in passwords, and these can be particularly difficult to remember.
Certainly people are foolish if they store logins for bank accounts and the like in the password manager, but most people only have one or two really important logins.
People who use the remember passwords functions are not idiots. People who expect the "remember passwords" functionality to be secure are not idiots either - if an application used by millions includes such functionality one would expect the developers to have secured it.
You'd probably begin to care after someone "hacks" your MySpace page and posts distasteful or illegal language or images. Explaining all of that to a police officer or a judge and jury is rife with peril.
But the other point I think is pertinent here is that Firefox is really going for the common man crowd -- you don't buy a full-page ad in the New York Times if you want only geeks. So knowing that the average joe will be using Firefox and will happily save sensitive information if encouraged to do so (as one is with Firefox), that particular feature really has to be pretty rock-solid (or at the very least, not vulnerable to a pretty basic and classic javascript exploit).
Don't get me wrong -- I love Firefox and use it almost exclusively. But this is the kind of thing that, whether truly a hazard to most users or not, can scare people away if it is carelessly presented to the public. Or if it really is a risk.
It is pitch black. You are likely to be eaten by a grue.
Now why any of it is Firefox specific? Any browser/ browser-helper-object /password help toolbar would do the same. If you have only one user name for a site, firefox will pre-fill the field. And the javascript can read it without a get or post. I would guess this behaviour of prefilling when the username is unique is probably a Firefox thing.
Generally sites that allow users to post javascript code would be dangerous and should not be visited. But I would not know a priori these sites.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
In addition if you run with Noscript and Secure Login it really helps protect you. The former can let you disable javascript (and java/flash too) by default and only enable for sites you trust. The later makes it so that for remembered passwords firefox does not fill in the form. Instead it highlights the fields it would fill in and you have to hit the secure login button to post the form data. Makes it so that you know when you saved passwords are being used and bypasses the input flow so that keyloggers can't even record the data.
I would also recommend installing "Master Password Timeout" which will re-prompt you periodically for the password.
Safari also vulnerable...
Pretty much all text is plane text. Unless it's 3 dimensional I guess.
i just attach the cables to my nipples and decode the packets manually.
Yeah, but can you generate outbound traffic?
- Open browser
- Click on MySpace bookmark
- Enter master password to login to myspace
- Visit joebob's page, which has javascript to steal your password
- pwn3d
If you're on the site with the vulnerability, you probably already entered your master password to login, and you only have to do that once per session to use all of your passwords.