Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×

Firefox 2.0 Password Manager Bug Exposes Passwords 315

Posted by kdawson from the be-careful-out-there dept.
zbuffered writes, "Today, Mozilla made public bug #360493, which exposes Firefox's Password Manager on many public sites. The flaw derives from Firefox's willingness to supply the username and password stored on one page on a domain to another page on a domain. For example, username/password input tags on a Myspace user's site will be unhelpfully propagated with the visitor's Myspace.com credentials. It was first discovered in the wild by Netcraft on Oct. 27. As this proof-of-concept illustrates, because the username/password fields need not be visible on the page, your password can be stolen in an almost completely transparent fashion. Stopgap solutions include avoiding using Password Manager and the Master Password Timeout Firefox extension, which will at least cause a prompt before the fields are filled. However, in the original case detailed in the bug report, the phish mimicked the login.myspace.com site almost perfectly, causing many users to believe they needed to log in. A description of this new type of attack, dubbed the Reverse Cross-Site Request (RCSR) vulnerability, is available from the bug's original author."
This discussion has been archived. No new comments can be posted.

Firefox 2.0 Password Manager Bug Exposes Passwords More

Firefox 2.0 Password Manager Bug Exposes Passwords

Comments Filter:

  • But but but.... (Score:5, Funny)

    by Anonymous Coward on Tuesday November 21, 2006 @06:29PM (#16941742)
    ...secure by design!!

    • I sense a disturbance in the force... (Score:5, Funny)

      by LordEd ( 840443 ) on Tuesday November 21, 2006 @06:33PM (#16941786)
      ...as though millions of Firefox users were laughing at IE users, and were suddenly silenced.

      Cue "still more secure" arguments now.

      • Re: (Score:2)

        by Fuzzums ( 250400 )
        Nope. I just prefer FF :D

      • Cue "still more secure" arguments now.


        Also, "it will be fixed by tommorow as compared
        to Microsoft's slow response" arguments.

      • Re:I sense a disturbance in the force... (Score:5, Funny)

        by ticklish2day ( 575989 ) on Tuesday November 21, 2006 @10:03PM (#16944388)
        I switched to IE7 a week ago after Vista RTMd. I don't miss FF. I've also been running without anti-virus for the entire week. I ran a system virus scan today and ZILCH - no viruses. No spyware or adware either. It might have to do with the fact that my machine isn't connected to a network...

  • passwords have failed (Score:5, Insightful)

    by hackstraw ( 262471 ) * on Tuesday November 21, 2006 @06:35PM (#16941816)

    Now that its 2006, can we now use a better form of "authentication" than a few ascii characters?

    Every website wants you to have a password. You know, for important stuff like making a purchase because you use a password for a purchase at a brick and mortar store, right?

    Well, since its a good practice to use unique passwords, and users get forgetful, then they use the web browser tool to store their passwords, then they forget their passwords, and when they use another computer or update their existing one, their tool does not work, and if it does work, then the browser gives away your passwords.

    I don't use a password to get into my home, I don't start my car with a password, I don't use a password to get into my work. In fact, I don't even have a key for my work, server room, nothing (RFID). But all day at work, these programs continually ask for my password to the point that I dont consider my password secure because I have to change it, and use it so much, I'm desensisized (sp?) and say who cares?

    Can we get over passwords soon?

    • Re: (Score:2, Funny)

      by Anonymous Coward
      Did you have a proposed solution? Or were just cryin' like a little bitch with a skinned knee and shit [imdb.com]?
      • How 'bout we tattoo a unique number onto a forhead of every person (and make it so that nobody could buy or sell without it) like the Good Book said we should?

    • Re:passwords have failed (Score:5, Insightful)

      by AlXtreme ( 223728 ) on Tuesday November 21, 2006 @06:50PM (#16942060) Homepage Journal
      I don't use a password to get into my home, I don't start my car with a password, I don't use a password to get into my work. In fact, I don't even have a key for my work, server room, nothing (RFID).
      Locks get picked. Cars get stolen. RFID can be disrupted, tampered with or your card can get stolen (I'm assuming you don't have RFID tags in your arm). Likewise, passwords can be sniffed. Hell, it doesn't matter how good your encryption is, all it takes is a videocamera pointed at your keyboard.

      How far you go, it doesn't matter. There will always be a trade-off between security and convenience. Personally, I trust a good lock more than I trust RFID. But even if you go all the way to biometrics, there will always be way a to hack the system.

      Even so, this Firefox security flaw is a nasty one.

      • Re: (Score:3, Interesting)

        by hackstraw ( 262471 ) *
        Locks get picked. Cars get stolen. RFID can be disrupted, tampered with or your card can get stolen (I'm assuming you don't have RFID tags in your arm).

        Someone across the world cannot pick a lock, steal a car, or disrupt an RFID tag, or any of those things.

        None of those things expire, have to be changed, have to be mentally remembered, cannot easily be given to another person without disrupting my use of them.

        Even simple locks that can be cut with simple wire cutters are more secure than a password because

    • Re:passwords have failed (Score:5, Interesting)

      by irc.goatse.cx troll ( 593289 ) on Tuesday November 21, 2006 @06:51PM (#16942070) Journal
      I strongly hope so. My recommendation would be public key authentication, the way SSH can do it. You'd need a private key (possibly on a crypto card, but a thumbdrive or floppy or whatever works fine) and a password for that. You authenticate to the key when launching your encryption agent, then any website that wants to verify who you are contacts your agent and does the authentication there.

      Infinitely more secure than our current password system, a lot more convenient (think Microsoft Passport's bragged about convenience, except none of your data is stored on a central server), and all around the BetterWay(tm). The main downside if when roaming to another machine if you don't have your key, you don't have access. This can be addressed with either being able to fall back on a password (removing a lot of the security), or some means of authenticating to your home computer.

      You could also add some sort of spec for feeding VCard info into the agent so that sites could use it to do a sort of shared profile feature, where you'd authorize a site to receive certain info and save you a lot of time filling stuff out.

      Unfortunately this is just yet another thing on the list of "tech the way I think it should be", not anything on anyones todo lists.

      • Re: (Score:2)

        by Xugumad ( 39311 )
        > The main downside if when roaming to another machine if you don't have your key, you don't have access.

        USB flash drives are becoming really popular. Some standard location on a flash drive to place a private/public key pair, would mean you could provide credentials just by sitting down at a PC and plugging in your flash drive. Having said that, then means losing the drive is... really, really bad. Also means a virus infected system could grab your keys, but then that's more or less a risk with password

        • Java ring? (Score:5, Interesting)

          by CustomDesigned ( 250089 ) <stuart@gathman.org> on Tuesday November 21, 2006 @07:11PM (#16942374) Homepage Journal
          Remember the Java ring? It had a processor and stored the private key in a tamper resistant case (erases instantly when case is compromised). PC programs would ask the Java ring to sign things. A virus could get bogus signatures while it was connected, but couldn't compromise the key. Unfortunately, it used a funky "One Wire" adaptor to get power and talk to a PC. If only they would reintroduce it in a USB format!

          • Re: (Score:2)

            by mmontour ( 2208 )
            Unfortunately, it used a funky "One Wire" adaptor to get power and talk to a PC. If only they would reintroduce it in a USB format!

            They do sell USB adapters for iButtons - see http://www.maxim-ic.com/products/ibutton/products/ adapters.cfm [maxim-ic.com]. However it looks like the crypto iButton itself has been discontinued. I hope that someone does release a similar product in the future, before the battery dies in the one I am currently using.

    • Re: (Score:2)

      by Xugumad ( 39311 )
      Yes! I'd love to see Firefox adapted to make client side certificates trivial (keep in mind that there's no need for the server to know that the client certificate is who it says it's from, only that the same certificate is always the same person), and more sites move to using SSL certificate authentication. For, y'know, useful things like never actually providing re-usable credentials to the server...

    • Re:passwords have failed (Score:5, Insightful)

      by Crudely_Indecent ( 739699 ) on Tuesday November 21, 2006 @07:02PM (#16942246) Journal
      Passwords work great for me. I, however, use them with care.

      Any site that uses financial information (my bank, eBay, PayPal, Amazon, or whatever I'm buying, my own servers, etc.) doesn't get the password stored in any form of password manager. On the other hand, inconsequential services like news sites, LUG sites, aquarium discussion groups and the like may have the passwords stored. If it's important, don't store it, don't write it on a post-it note, don't tell your friends.....people cannot be trusted.

      It seems that any security protocol can be circumvented by exploiting the end users who use them poorly or rely on something other than common sense for security.

      It took all of about 5 minutes to explain phishing to my girlfriend. Now, she's almost 1/104358506th as paranoid as I am, which is a good start.

      Now, I'm out of tinfoil......off to the store.
    • The bigger problem is automatic passwords for websites. I never understood why such a feature would be installed. it's far safer to use a third party app, and look up the passwords as you need them. I can remember some but not all of mine. but all I need to remember is three.

      one to log onto my machine. One to decrypt an encrypted filesystem, and the third is for application in which I store the information. With OS X I can literally click twice, type in both passwords and can look up the forgotten pas
    • OpenID seems to be the right approach to this. Login once (Passport-like), but to your own server -- it could be a password, a key exchange, whatever, the idea is to produce some sort of session cookie that your server can check. You can login to any other site, but through a process which doesn't give that site any kind of credentials to use on other sites, and you can restrict which sites may check your identity at all.

      I'm not sure how this would protect against this kind of vulnerability, but I am convin

    • Re: (Score:2)

      by daeg ( 828071 )
      Do you trust websites to have anything more than a few ASCII characters? While I'm all for more secure banking websites and securing authentication to a network server or secure authentication to my workstation, I don't trust websites with much more than what they absolutely need to serve me.

      What would you give them? Fingerprint? SSN? Photo? Voiceprint? Those are all things you cannot change. With an ASCII password, at least you can change it or throw it away.

  • Is it used? (Score:5, Insightful)

    by oyenstikker ( 536040 ) <`slashdot' `at' `sbyrne.org'> on Tuesday November 21, 2006 @06:35PM (#16941818) Homepage Journal
    People actually let their browsers remember their passwords? I have never trusted my browser that much.

    • Re: (Score:2, Funny)

      by wumpus188 ( 657540 )
      That's what this new service is for. Let others remember your passwords!
    • Well considering the first time you enter form information FF prompts you to "Save information so you dont have to type it again", well what clueless luser wouldn't do that? Lusers hate to type!

      Saving passwords should not be a browser feature. I am ashamed that such a big bug could make it into firefox. Hopefully staying on 1.5 and not using any sort of "password management" (except cookies) will keep me safe from this. At least it will probably be ficed today, if it hasn't already been fixed.

      • Re:Is it used? (Score:4, Insightful)

        by Phroggy ( 441 ) * <.slashdot3. .at. .phroggy.com.> on Tuesday November 21, 2006 @09:42PM (#16944208) Homepage
        Saving passwords should not be a browser feature. I am ashamed that such a big bug could make it into firefox.

        Saving passwords absolutely should be a browser feature; it's a feature I use all the time.

        However, I too am ashamed that such a big bug - or rather, design flaw - could make it into Firefox. I understand the usefulness of being able to use the same saved password information across multiple login forms on one site, but surely someone should have realized the danger here. I mean, these are browser developers. They should have known better.

        Hopefully they'll figure out a solution soon.

    • Not a lot of better options (Score:5, Insightful)

      by Kadin2048 ( 468275 ) <slashdot...kadin@@@xoxy...net> on Tuesday November 21, 2006 @06:51PM (#16942068) Homepage Journal
      If you have 50-100 passwords at various sites, established over years, there's really a shortage of other good options. You can go the old-school route and just write them all down on a pad of paper, or the slightly more sophisticated route and put them in a text file or encrypted database on your local machine, but that doesn't help you when you want to log into a site from another machine.

      I was disappointed to hear of this vulnerability, because I use Google Browser Sync pretty heavily for keeping track of cookies and trivial passwords, and to be honest I'm not really sure what I'd do without it. More important passwords I keep in an old Palm Pilot using a GPLed password-management and generation program on it, but recalling passwords from it is a pain (takes several minutes to get Palm out, type in master password, etc.).

      • Re: (Score:2)

        by Bogtha ( 906264 )

        I was disappointed to hear of this vulnerability

        I was puzzled to hear of this vulnerability. I am certain this exact topic has come up before in relation to saving passwords, over a year ago. I thought it was going to be addressed by making the forms non-submittable by JavaScript, and giving the input fields fake blank values when JavaScript read them - of course, only when the form information was automatically entered by the browser.

        Did I just imagine all that, or can somebody else confirm this

    • Re:Is it used? (Score:4, Interesting)

      by Firehed ( 942385 ) on Tuesday November 21, 2006 @06:55PM (#16942134) Homepage
      It's not your own browser to worry about. It's others browsers. My roommate decided to borrow my machine and was stupid enough to have Firefox remember his password on my machine to the main school portal. No biggie, except that the 'reveal all passwords' button exists (and, last I checked, required no authentication to use).

      Of course, the truly telling moment was when I found out how lame his password is. Not that I'd expect anything different from someone dumb enough to store their password on someone else's computer in the first place.

      So, in other words, passwords continue to be useless for people dumb enough to leave them lying around. I've used the same password for years and it's by no means secure (only just a bit more secure than using my first name) but it's never been an issue for me. The only time I've been concerned is when websites force me to come up with something that fits their requirements, because that means that I do end up writing it down somewhere. The sooner webmasters realize that setting specific requirements for passwords makes them less secure (my bank requires an alphanumeric PW 6-8 letters long with mixed case - that massively narrows down a brute force attack), the better. In the end, most of it comes down to user stupidity, so we might as well not limit the complexity of good users or force them to use something too obscure to remember (or, worse, say 'write this down in a place you can easily access').

      • Re:Is it used? (Score:5, Informative)

        by Odiumjunkie ( 926074 ) on Tuesday November 21, 2006 @07:25PM (#16942566) Journal
        > No biggie, except that the 'reveal all passwords' button exists (and, last I checked, required no authentication to use). Firefox, for as long as I can remember, has allowed you to set a master password, without which the password manager will not populate any password feilds and will not allow the viewing of any stored passwords.

      • Re: (Score:2)

        by geekoid ( 135745 )
        "the truly telling moment was when I found out how lame his password is. "

        so, what was it?

        • Re: (Score:2)

          by Firehed ( 942385 )
          kitcivic
          No, I won't tell you the school or the username. But if you want to dig around, go ahead - my name and college are certainly out there if you want to look at his course schedule.
    • Does anyone know if this attack is possible on Opera? Opera's wand has been around longer than FireFox has, so I'm kinda curious. It seems like something people could exploit in more than just FireFox.

      • Re: (Score:3, Informative)

        by NexusTw1n ( 580394 )
        Opera has indeed been around longer, and most of the ideas in FF such as tabs and mouse gestures, and wand, were done first in Opera.

        It's why this vulnerability is so stupid, all the FF team had to do was copy the way Opera does it.

        In order to use the password manager, you need to click on the wand, or hit ctrl & enter together.

        The ctrl enter shortcut is a beautiful idea, because after recalling the password, it "clicks" the button that currently has focus, which is usually the "login" button, so most o

    • Re:Is it used? (Score:5, Interesting)

      by makomk ( 752139 ) on Tuesday November 21, 2006 @07:26PM (#16942578) Journal
      I use Konqueror/KWallet to remember most of my password. It's encrypted (requires a password to access), only fills in the forms on the page you originally hit "Save Password" on (inconvenient, but helps reduce the security issues), and closes the wallet (requiring re-entry of the password) when I lock my screen, my screensaver starts up, or after 10 minutes of non-use of the wallet. Slightly paranoid compared to Firefox, but it works.
    • Yeah I do. It is like I use the Web a lot. Think SlashDot, think Del.Ic.iosus..whateva think whatever little forum or not so important web service. I do store the password in browser. What else do you suggest? Remembering 100+ different passwords maybe is possible for me but I've got better things to do. :)

      I use quite common scheme - I don't care about remembering my passwords at all if they are related to not so critical things like my Slashdot account, Bugzilla account for project Foo etc. etc. - I genera
    • People actually let their browsers remember their passwords? I have never trusted my browser that much.

      It's sad that you don't have a loving, trusting relationship with your browser. Perhaps you should get some therapy...

    • Re: (Score:2)

      by Kanasta ( 70274 )
      1) You really care if someone stole your pw at say /. or a forum? And every dumb site now requires a login...
      2) Banking sites don't seem to get their PWs saved anyway, as much as I'd like them to.

      3) in the end, your ISP has your PWs, so if ur important enuf, ppl can get your stuff.

  • Stopgaps solutions are not a solution, I guess they're planning a 2.0.1 soon? The bug has been reported 10 days ago...

    • Re: (Score:3, Insightful)

      by gad_zuki! ( 70830 )
      Its so calm in here. If this was IE most of the posts would be "WTF M$, 10 DAYZ!!!!!!!! Switch to firefox now!!!!!" Go figure.

  • Arrrrr (Score:4, Insightful)

    by Peyna ( 14792 ) on Tuesday November 21, 2006 @06:36PM (#16941834) Homepage
    The flaw derives from Firefox's willingness to supply the username and password stored on one page on a domain to another page on a domain.

    Worst idea ever. The question isn't why wasn't this discovered earlier, but who decided this was a good idea in the first place?
    • Agreed. I've had to help too many people who use autofill passwords and don't know the passwords when they change machines or use another pc. I avoided the whole thing because it seemed likely to allow me to forget passwords, and didn't seem totally secure.
    • actually this is a great idea for all those stupid sites that require you to have a user-name and password for no particular reason. With FF I can put in whatever garbage info I want for the registration and it will remember the login for me next time I load the page. Obviously, for important sites (e.g. not a myspace account) I tell FF to not remember the password.

      Yes, this vulnerability is a problem and needs to be fixed, but let's not throw the baby out with the bathwater.

      And for you, Mr-I-Dont-Like-It

      • Re: (Score:2)

        by Peyna ( 14792 )
        It's a good feature when it works only for each site. But why should it be taking what I put in at gmail to log in and sticking that login/password into some other site? That's the problem.
        • Though to be clear exactly it will only forward form input to URLs that appear in form inputs on the same site (domain, that is.) Like the article says, it will only allow say a myspace user to steal your myspace password, he won't be able to steal passwords from other domains, though he will be able to use a non-myspace site to collect the stolen information and that's the bigger portion of the problem. I don't know whether I would classify this *only* as a bug in the browser, rather also a bug in the we
      • I end up using different computers enough that this would be an inconvenience. I'd be ok until I was somewhere that didn't know my passwords, then I'd have to go through the unpleasant retrieval process just to post to slashdot.

        I also don't want to cultivate habits that'd give out my password to firefox on whoever's machine I'm on.

    • Re:Arrrrr (Score:5, Insightful)

      by jesser ( 77961 ) on Tuesday November 21, 2006 @06:58PM (#16942172) Homepage Journal
      When browsers added password management features 5 (?) years ago, there weren't a lot of sites that required passwords, included user-generated content, and allowed that user-generated content to include password fields. But there were (and still are) many sites where loading just about any URL on the site could give you a "you need to log in" page.

      I'd be perfectly happy with this becoming part of the accepted security model for web applications, just like "don't let user-generated content include SCRIPT tags with arbitrary content".
      • > When browsers added password management features 5 (?) years ago, there weren't a lot of sites
        > that required passwords, included user-generated content, and allowed that user-generated content
        > to include password fields.

        So the bug isn't really in Firefox at all. It's in the Web sites.

    • >>The flaw derives from Firefox's willingness to supply the username and password stored on one page on a domain to another page on a domain.

      >Worst idea ever. The question isn't why wasn't this discovered earlier, but who decided this was a good idea in the first place?

      Well, if they read /., it would seem the site is it.slashdot.org, games.slashdot.org, and a mess of other sub-domains. I can see why they might think subdomain 'sharing' was a good idea. Logging in on my blackberry is a real treat

  • Not just Firefox 2.0, also IE6/7 and earlier F'fox (Score:5, Informative)

    by Andy_R ( 114137 ) on Tuesday November 21, 2006 @06:39PM (#16941870) Homepage Journal
    According to the Bugzilla link, this bug is also present in pre 2.0 releases of Firefox, and IE 6/7.

    So much for me being smug about going back to Firefox 1.5!
    • I'm running 1.5 and the exploit worked for me.

    • Re: (Score:3, Informative)

      by TheNetAvenger ( 624455 )
      According to the Bugzilla link, this bug is also present in pre 2.0 releases of Firefox, and IE 6/7.


      They say it exists in IE 6/7, so they don't look like the only fool.

      So how do they explain the fact that it really 'doesn't exist' in IE 6/7, and doesn't this make them look even more foolish?

      And no I won't defend IE6 or even IE7. But keep the facts where they are; this is not an IE exploit.

  • stopgap measures include... (Score:4, Funny)

    by Gary W. Longsine ( 124661 ) on Tuesday November 21, 2006 @06:39PM (#16941876) Homepage Journal
    ...using Microsoft Internet Explorer. AAaaaaaaaaaaaargh!

  • Dis-satisfied with v2.0 (Score:4, Informative)

    by macdaddy ( 38372 ) on Tuesday November 21, 2006 @06:45PM (#16941984) Homepage Journal
    I don't know about everyone else but I am generally dis-satisfied with v2.0. Frankly I felt that the memory leak in FF was significantly amplified in 2.0. I noticed back on 1.5 that every time I put my laptop into standby with FF running and then woke it up that FF would slowly increase it's memory consumption to about 30% more than what it was before being put into standby. Ie, if it was 100MB when it went to standby it would be around 130MB after waking the laptop, switching focus to FF, and clicking through my opened tabs. In FF 2.0 I have to literally shutdown FF every day or two or FF will easily consume upwards of 500MB of my RAM. I usually have about a dozen windows open and in each window I have 5-15 tabs. That's a fair bit but it didn't cause me much grief in v1.5.

    It also took me a while to figure out how to remove the close button from each tab [wordpress.com]. The tab scrolling "feature" was also a point of great annoyance that took up more of my time to find a fix [lifehacker.com].

    In short I'm just not jumping for joy over FF. This new flaw happens to come to light the day after I search Google for a way to manually add userids and passwords to the FF DB (any ideas?). This was to address the problem of FF not picking up some text fields as userid and password fields. One solution I found was RoboForm [roboform.com], though I'm not sure I want to pay for what I think should be a fairly easy thing to do inside FF. FF is getting better but personally I'd rather be using Mozilla 1.7.x.

    • They took out the "load images from the originating site only". That was the only safe way I could surf fark.com at work, since forum posters just LOVE to post not-work-safe images. That, and I worry about someone posting an image from a porn site, and the firewall logs would be on me.
  • I love firefox and am very thankful for it being opensource but I loathe how Mozilla chooses to track and report bugs. I have been going around for days and could've been exploited - possibly but not probably - instead of being able to take appropriate measures to protect myself. It's not like this was some little secret the code was already out in the wild to do it. I find this security through obscurity in opensource projects absolutely disgusting. While we are possibly getting compromised they are sittin
  • I thought the rule of thumb for any user-created content was to never allow freeform html? You either let them control their formatting with a separate markup (like BBCode), or you limit them to specific tags (like they do here). In neither of these situations is this exploit possible.

    Allowing full html coding, including embedding java or javascript, is an invitation for the unscrupulous. That's one of the 500 reasons I can think of to never visit a website like myspace.

    That said, much like language, the

    • Re: (Score:2)

      by bwy ( 726112 )
      Allowing full html coding, including embedding java or javascript, is an invitation for the unscrupulous. That's one of the 500 reasons I can think of to never visit a website like myspace.

      I don't think your logic makes sense. Any scammer out there can get a nearly free hosting plan and upload whatever content they want. Using your logic, you'd never visit any web site created by anyone. You'd certainly never click a link on Google because you have no way of knowing what is on the other end (and you'd

      • Re: (Score:3, Informative)

        by Bogtha ( 906264 )

        Any scammer out there can get a nearly free hosting plan and upload whatever content they want.

        Yes, but that's not a problem because they aren't on a domain where you have a saved password. The problem here is that random people can upload content to, say, myspace.com, and if you have a password for myspace.com, your browser will automatically fill their form in. When an attacker uploads something to attacker.example.com, you aren't going to care because you don't have a saved password for attacker.

    • I agree that the bug is first and foremost due to myspace, but the Firefox Password Manager certainly doesn't help. It should be clever enough to not fill out that particular form, as it does not direct to the myspace domain. Hopefully this will be fixed as soon as possible; seems to me that it shouldn't be such a huge fix.

      But back to myspace. This fake form is extremely insidious, and looks exactly like the real thing. Only a viewing of the source HTML will reveal that there's something fishy. Allowing us

  • That is Scary (Score:2, Informative)

    by EricJ2190 ( 1016652 )
    That is disturbing to me since I use FF2 to store many of my passwords. However, I don't store passwords for more critical sites, like my bank's website. I recommend others do the same.

  • no need to save passwords --generate em on the fly (Score:5, Interesting)

    by caseih ( 160668 ) on Tuesday November 21, 2006 @07:05PM (#16942278)
    There is a neat little piece of javascript at http://www.xs4all.nl/~jlpoutre/BoT/Javascript/Pass wordComposer/ [xs4all.nl] that lets you just think up a master password in your head and then use this applet to automatically generate a site-specific, unique hash and fill in the password field automatically. This way you can remember the passwords easily, you never have to save them or write them down. And if one site gets compromised, that password (the hash) won't work with any other site. The drawback is that if you don't have this piece of javascript then you can't get into your sites.
    • They're just using MD5, which you could reproduce on any computer. In fact, that's how I generate _all_ my passwords:

      echo "user:domain:iteration:masterpass" | binary hash | base64 | take first 16 characters

      It's a simple algorithm which you don't need to keep secret. Also, you can write down the made-up user/domain/iteration triplets. All you need to keep secure is the master password. Thanks to the iteration, you can lose a generated password without affecting the secrecy of your master password or all the
  • Aha!... that's why sometimes I don't remember posting bad language comments!

    Thought until now of multiple personality but mystery solved! It was just my browser!...

    PS: I shall not be held accountable for ANY of my comments...

  • Does anyone know if Konqueror (using KDE Wallet) is affected? And what about other browsers, like Opera, Epiphany, and so on? I'd just like to know how common this type of exploit is.

  • WARNING (Score:4, Informative)

    by tezbobobo ( 879983 ) on Tuesday November 21, 2006 @07:35PM (#16942732) Homepage Journal
    DEERPARK 1.5.0.4 is also vulnerable - based on firefox 1.5
  • If you have form autocomplete on, credit card numbers are stored in plaintext on your hard disk too. Bug's been open for .. what about 4 years now.

    They refuse to fix it, they say it's not a bug.

    I don't think it's vulnerable to this because it's not fully automatic, however, all someone has to do to get your credit card number is type the first digit and it'll fill in the rest.

    Their advice, "Don't use autocomplete".

  • Alternatives to browser stored passwords (Score:4, Informative)

    by natet ( 158905 ) on Tuesday November 21, 2006 @07:55PM (#16943060)
    I for one only use the browsers store password feature for the most trivial of sites. For more important sites, I use Password Safe [sourceforge.net]. The program and the database fit easily on a thumb drive, and requires a master password to access. It has a user configurable time out, and a double click on an account copies the data to the clipboard for later use, allowing you to foil keyboard based sniffers.

  • Thank God! (Score:3, Funny)

    by PHAEDRU5 ( 213667 ) <instascreed@gm[ ].com ['ail' in gap]> on Tuesday November 21, 2006 @09:07PM (#16943866) Homepage
    I have MS password management to control access to my Firefox password manager.

    Phew!

  • Password safety (Score:3, Informative)

    by Pedrito ( 94783 ) on Tuesday November 21, 2006 @09:11PM (#16943922)
    I have two types of passwords: The ones for fluff sites, like Slashdot, Wikipedia, hotmail (a.k.a. Spam box), and so forth, which usually get 1 of 2 passwords. Then for banks and credit cards and what have you, I use real passwords with different ones for each site.

    I could care less if someone hacks my Slashdot account or my wikipedia account. The worst thing they can do is vandalize under my name. And as for hotmail, they can have my spam. And were I to have a myspace account, I could care less if someone got that too.

    Fortunately, my bank and credit card companies don't allow others to create their own pages, so I'm not too concerned. I suspect this will get fixed long before it becomes a concern for me.

  • Hey (Score:2)

    by Ant P. ( 974313 )
    I was poking around a few days ago trying to get a userContent.css file to use a local filesystem png file as a background, without having to resort to huge data: URIs.
    Eventually I'd thrown enough random ideas at the problem that I ended up finding out about this nightmare waiting to happen [mozilla.org]. Just for kicks I tried putting some code in the CSS to alert() all the (supposedly hidden) password values on the page. It worked.
  • I don't mind that the program allows me to be stupid. Big deal...... I do mind however things like drive by hacks, (via activeX) cross-site scripting (ala JavaScript) etc. But do I expect the browser to be my mommy.... NO As for the supposed FF memory leak. That isn't the one that should affect you the most.... Cerebellum Memorus Diareatalis should.

  • myspace... (Score:3, Informative)

    by DeadboltX ( 751907 ) on Wednesday November 22, 2006 @05:43AM (#16947128)
    It is not a bug with firefox, it is a bug with myspace.
    I doubt you will find many places other than myspace where this "bug" will be exploited. Why? Because most sites that host user generated content are responsible enough to remove the users ability to post potentially-malicious markup language on the site. These sites strip almost all (if not all) markup and only allow a small handful of decoration tags like BOLD. (Slashdot is a perfect example of allowed html markup)

    The problem is that the code on myspace is shoddy at best, and the fact that users can put any kind of html on their myspace page was an accidental result of such. Then when users figured out they could customize their page with css and other markup code they were happy, and so myspace left it in.
    Nowadays everyone is so used to myspace letting them customize their page (in a shitty hack sort of way) that if they were to take that aspect away I think myspace would die in a month (I know a lot of girls who only go on myspace so that they can upgrade their page and make it look better by customizing it) so they are not likely to ditch this "feature" of their site.

Slashdot Top Deals

It is now pitch dark. If you proceed, you will likely fall into a pit.

Close