firefox and saved passwords... easy to see

[bjork]

call me a noob, but how easy is it to find out someone's passwords that uses internet explorer?

i know if IE has a password saved, you can use a dropdown, select their username, and it will fill in the "*******" of their password, and you could log in, but you still wouldn't HAVE the password. even if you selected the asterisks, copy and pasted it into notepad, you end up with garbage.... not a plain text rendering of the password.

i mean, are these easy to find in the registry or something? can i dig up a text file somewhere that has them sitting out in plain sight?

i just DLed firefox 1.5, and was lookig through the options... there's a "saved passwords" tab in there, and if you click a button it will just spit out all your usernames and passwords in plain text in one easy to read window.

like i said, call me a noob.... i know firefox "got them from somewhere", but i guess i just never realized where that was. it just seems like it would be a pretty simple process to retrieve them... they aren't hashed or whatever?

 

[MorfiusX]

As far as Windows goes, there is a hack that will enable some one to view what's behind the astericks. Using the hack, Windows will no longer hide a password.

With FireFox, you can set a master password so that in order to retrieve a password from the list, you have to enter the master password first. All of this, I think, is encrypted. Try looking in the User.js file.

 

[bjork]

ok, that pretty much answered my question.


the firefox master password option requires you to type your "master password" every time you launch the browser.

the windows version needs to be intentionally hacked to view passwords.

this is nothing new... i know i can get reset any windows system's administrator password with an easily obtainable (free!) linux boot cd. so i won't even try to say microsoft "code is secure" or whatever... but i was just a little shocked when i found all my usernames and passwords hanging out in the breeze 30 seconds after having installed firefox. like i said... firefox obviously "got them" somewhere from within windows, i was just curious where.




i keep trying firefox, because people get so ooh and ahh over it, but i'm typing this in IE, so...

 

[YARDofSTUF]

Shouldnt have passwords saved anyway. By saving a password you are creating a security threat.

 

[tazman4]

Shouldnt have passwords saved anyway. By saving a password you are creating a security threat.

Yep... password save = bad idea.