Skip to content

The Firefox password manager is leaking information

by razvanpetru on July 16th, 2010

It’s very annoying to have the master password dialog pop up every time you visit a site that has its password stored by Firefox. Let’s say that I want to browse reddit: when I open a reddit page, the master password dialog pops up. I don’t want to login, so I cancel the dialog.

Then I see an interesting story and open it in a new tab. Here comes the master password dialog and it gets killed again. Now I use the new tab to surf to /r/cpp. The master password dialog cheerfully strolls into view.

Popping a dialog when the user selects a user name filed would be better, as it avoids leaking membership information when visiting a web site. I would also like to see this dialog redesigned – right now it’s a simple application-modal message box with an editor widget in the middle. If you have ten tabs open and you open another tab to a site that has its password stored, you won’t be able to interact with any of the tabs until you either enter the master password or dismiss the master password dialog.

From → Software design

Comments are closed.