Thursday, October 4, 2007

Firefox's "functionality" to show your saved passwords in clear text

While making a joke about Firefox, I noticed that a lot of people don't know that Firefox has a functionality that makes it possible to show your saved passwords. This can be handy for you whenever you forget one but also very handy for someone who uses your pc with the same account.

Before judging, I must say this password manager can be disabled or secured but by default it is enabled without security.


The problem

If you browse to a site that requires you to sign in with name and password (for example http://www.gmail.com/), Firefox will give you the possibility to save your password as in IE.

However, with Firefox it is possible to actually see the passwords in clear text. This is how to do it:

  • Go to Tools\Options and select the Security tab

  • Click “Show Passwords”
    This will open a new screen and show you the sites and accounts; not the passwords.

  • Click “Show Passwords” and choose “Yes” in the warning dialog (don’t do this when other people are standing next to you)

    This will add an additional column in the table which shows your passwords in clear text.

I think you understand that this can be dangerous!

The solution

As mentioned before, there is a way to disable (by unchecking the "Remember passwords for this site" option) or secure this.

To secure this, Firefox uses a master passwords to access your saved passwords. You can do this by checking the “Use a master password” in the “Security” tab from the Options window. Firefox will ask you to enter a new password.


The master password needs to be entered each time you want Firefox to use your saved passwords or to view the list of passwords.