"Show Passwords" option should remove, It would be hack anyone's important accounts from all/any websites
Categories
(Toolkit :: Password Manager, defect)
Tracking
()
People
(Reporter: vishnubhaigude1, Unassigned)
Details
Attachments
(1 file)
"Show Password" option shoud remove, Saved Passwords would be bank account details / business ID's / official accounts etc. & Its risky & not secure
|
||
Comment 1•8 years ago
|
||
|
|
||
Updated•8 years ago
|
|
|
||
Comment 2•8 years ago
|
||
| Comment hidden (advocacy) |
|
||
Comment 4•5 years ago
|
||
(In reply to jython.scripts from comment #3)
16 years ago they were discussing how showing plain text passwords is bad. Now this password manager collects them all into one neat little group so it is very easy to obtain ALL passwords for ALL webpages on ANY unattended pc.
This hasn't changed in the last 10+ years btw. All we did was change the UI and add more entry points but the function to reveal saved passwords was there.
It made me think how corporate unfriendly Firefox is because it "locks the door" but forgets to remove the key, and makes it super easy to gain access to
How are we "corporate unfriendly" when we provide an enterprise policy to disable this feature? :P
And I know a master pass is there, but that has so many drawbacks it is practically useless. I am a network technician with a snappy brain, I remember my PWs all day long. I don't want a browser that forces me to use grandma tools that sacrifice my (company's) security without giving options to disable it.
We do provide an option to disable it… see above.
16 years ago this feature should have been allowed to be disabled by prefs. And 16 years later this feature should still been allowed to be disabled by prefs, or removed would be even better. Why no one has ever sued because they were breached by this obvious open vulnerability is beyond me...
Have you thought about how trivial it would be for someone to change the pref back? That's not a solution.
Please fix this 16 year old bug so firefox will be much safer in both practice and in theory.
Please use the DisablePasswordReveal enterprise policy if you want to disable this feature.
|
||
Comment 5•5 years ago
|
||
Hi Matthew, maybe you are right. I was not aware of DisablePasswordReveal policy, I will look at using that for now. I only said it was corporate unfriendly because of the reactions I was seeing when I show my bosses their own passwords and they flipped - maybe it was their fault, who knows but no one ever told them about it.
"""Have you thought about how trivial it would be for someone to change the pref back? That's not a solution."""
Yes I have actually, but after discussions I think it dawned on me the proper implementation for toggleable behavior while also secure.
- If user disables this pref then Firefox will not show plain text passwords to anyone, ever, including grandma or evil sister.
- Now user can use autofill unimpeded, password manager, it is now impossible for people use password manager to reveal them.
- Now (the important bit) if the user wants to re-enable the password manager preference - Firefox states "I will first have to erase all stored passwords before this feature can be enable. Would you like to continue?"
So the password manager could be easily toggled for anyone who actually want's to use it. I personally would not and I think having an organized list of plain text user credentials anywhere makes it tempting for stealing them. I am not sure why anyone would use a password manager unless they are forgetful and too lazy to just go and reset their PWs if they forgot them.
I honestly don't wish to be burdened by DisablePasswordReveal this or MasterPass that, I would be happy if firefox let me just rip that manager out and continue on my way.. But whatever you guys think is best, and after 10+ years of status "won't fix" says it all...
Description
•