SoylentNews

Mozilla Firefox Bug Let Third-Parties Access Saved Passwords

posted by janrinok on Sunday August 18 2019, @10:33AM   
from the I've-always-used-********** dept.

Fnord666 writes:

Mozilla patched a vulnerability in the Firefox web browser with the launch of the 68.0.2 release which would allow unauthorized users to copy passwords from the browser's built-in Save Logins database even when protected with a master password.

"Stored passwords in 'Saved Logins' can be copied without master password entry" according to Mozilla security advisory, which also rates the security flaw tracked as CVE-2019-11733 as having a 'moderate' impact.

The flaw allows anyone with local access to a computer running an unpatched version of Firefox to go to the Save Logins dialog available in Firefox's Options > Privacy & Security preferences menu and copy the password stored for any of the saved logins by right-clicking and choosing the "Copy Password" option.

"When a master password is set, it is required to be entered before stored passwords can be accessed in the 'Saved Logins' dialog," says Mozilla.

"It was found that locally stored passwords can be copied to the clipboard through the 'copy password' context menu item without first entering the master password, allowing for potential theft of stored passwords."

Mozilla Firefox Bug Let Third-Parties Access Saved Passwords

---

Original Submission

• Re:To be fair... (Score: 2) by c0lo on Sunday August 18 2019, @07:26PM

  by c0lo (156) on Sunday August 18 2019, @07:26PM (#881844) Journal

  However, given the track record of browsers (including Firefox) with security bugs, as well as the fact that they seem to be releasing updates every week these days (often to fix security bugs) makes me nervous to put my trust in them.

  ^{(Let me check to see if I said such a thing. Nope, I didn't)}

  I'd prefer to have a dedicated piece of software devoted specifically to maintaining security of passwords, and I don't think that's an irrational decision.

  The rational decision for me is not to rely on any piece of software to manage my passwords (more like passprhases, at 15+ chars long. I'd use longer, but most of the places I deal with limit them at 20 chars).
  After all, I need to keep about.. let me see... 6-7 of them to be at "top security" level. The rest either don't mater if cracked or are even throw aways.

  --
  https://www.youtube.com/watch?v=aoFiw2jMy-0 https://soylentnews.org/~MichaelDavidCrawford

  Parent

  Starting Score:	1		point
  Karma-Bonus Modifier		+1
  Total Score:		2