Is it safe to let my browser remember passwords?

If you're at all wondering why this is even an issue, in Firefox do the following:

• Click on the Tools menu
• Click on the Options menu item
• Click on the Security tab
• Click on the Saved Passwords... button
• Click on the Show Passwords button

Yes, the Show Passwords button.

A few clicks and all your passwords are visible.

While I've obscured my own information, that dialog shows a list of URLs, Usernames and Passwords as remembered in my copy of Firefox. All we had to do was walk up to the computer follow the simple instructions above to make all passwords clearly visible.

That should have you thinking very carefully about your security.

Anyone who can walk up to your computer can do that, and pretty darned quickly.

What can you do? There are several approaches.

• Do nothing but rely on physical security. Depending on your circumstances, this may be a viable approach. The key is that you must be certain about your physical security. That means you know that you machine cannot be easily stolen, and that no one can simply walk up to it and access Firefox's remembered password list.

• Clear the list and stop remembering passwords. This is actually what I recommend for laptop or portable computers. As an alternative, I use Roboform which allows me to store my password database where I choose, and I choose to store it on an encrypted TrueCrypt volume.

• Use a master password. Firefox allows you to select a master password which is used to encrypt the stored passwords. In theory, without knowing the master password, you cannot access the stored passwords. Here's the problem: I was able to find at least one password cracking tool aimed specifically at the Firefox master password. If someone with malicious intent can steal your computer, or Firefox's encrypted files, they still have a reasonable chance of breaking through this security and gaining access to your stored passwords. As with any password, one key is to make it as strong as possible.

That last one concerns me slightly.

My take is simply this: it's like a padlock. It'll keep most people out. However, if someone who knows what they're doing comes along with a large enough crowbar or a bolt cutter it's possible that they could get it.

The real question is what should you do? Unfortunately, I can't answer that for you. It's a situation where you need to understand and balance the real risks that you face, the cost of a compromise, and the inconvenience.

I can throw out a few rules of thumb that I would use:

• Never allow your passwords to be remembered on a portable computer - at least not without some additional level of much stronger security.

• If you're ever uncertain, at a minimum throw a master password on the list. That's a fast and only moderately inconvenient way to keep out all but the most dedicated or knowledgeable hacker.

I'll also put it another way: even though its theft is unlikely, as a result of writing up this little thought exercise I've just cleared the list of remembered passwords on my home desktop and unchecked the option to remember for me. The cost of failure is simply too high should my machine ever be stolen or otherwise compromised.

I'm much more comfortable relying on Roboform and TrueCrypt.