Helping people with computers... one answer at a time.
Saving passwords for you is a convenient feature of most browsers. It's important to understand that with that convenience comes risk.
If I consider my computer to be physically secure, am I reasonably safe letting Firefox remember my passwords (without using a master password), or am I being incredibly stupid to do that? What if I do use a master password?
I certainly wouldn't say incredibly stupid at all. But it's definitely an additional risk, and one that needs to be understood.
But you're correct in considering physical security first. The problem is that people often assume they have more physical security than they actually do.
And master passwords? Well, they're nice, but they too have their limitations.
If you're at all wondering why this is even an issue, in Firefox do the following:
Yes, the Show Passwords button.
A few clicks and all your passwords are visible.
While I've obscured my own information, that dialog shows a list of URLs, Usernames and Passwords as remembered in my copy of Firefox. All we had to do was walk up to the computer follow the simple instructions above to make all passwords clearly visible.
That should have you thinking very carefully about your security.
Anyone who can walk up to your computer can do that, and pretty darned quickly.
What can you do? There are several approaches.
Do nothing but rely on physical security. Depending on your circumstances, this may be a viable approach. The key is that you must be certain about your physical security. That means you know that you machine cannot be easily stolen, and that no one can simply walk up to it and access Firefox's remembered password list.
Clear the list and stop remembering passwords. This is actually what I recommend for laptop or portable computers. As an alternative, I use Roboform which allows me to store my password database where I choose, and I choose to store it on an encrypted TrueCrypt volume.
Use a master password. Firefox allows you to select a master password which is used to encrypt the stored passwords. In theory, without knowing the master password, you cannot access the stored passwords. Here's the problem: I was able to find at least one password cracking tool aimed specifically at the Firefox master password. If someone with malicious intent can steal your computer, or Firefox's encrypted files, they still have a reasonable chance of breaking through this security and gaining access to your stored passwords. As with any password, one key is to make it as strong as possible.
That last one concerns me slightly.
My take is simply this: it's like a padlock. It'll keep most people out. However, if someone who knows what they're doing comes along with a large enough crowbar or a bolt cutter it's possible that they could get it.
The real question is what should you do? Unfortunately, I can't answer that for you. It's a situation where you need to understand and balance the real risks that you face, the cost of a compromise, and the inconvenience.
I can throw out a few rules of thumb that I would use:
Never allow your passwords to be remembered on a portable computer - at least not without some additional level of much stronger security.
If you're ever uncertain, at a minimum throw a master password on the list. That's a fast and only moderately inconvenient way to keep out all but the most dedicated or knowledgeable hacker.
I'll also put it another way: even though its theft is unlikely, as a result of writing up this little thought exercise I've just cleared the list of remembered passwords on my home desktop and unchecked the option to remember for me. The cost of failure is simply too high should my machine ever be stolen or otherwise compromised.
I'm much more comfortable relying on Roboform and TrueCrypt.
Comments on this entry are closed.
If you have a question, start by using the search box up at the top of the page - there's a very good chance that your question has already been answered on Ask Leo!.
If you don't find your answer, head out to http://askleo.com/ask to ask your question.