Firefox 2.0 Password Manager Bug Exposes Passwords

[ronjor]

"Today, Mozilla made public bug #360493, which exposes Firefox's Password Manager on many public sites. The flaw derives from Firefox's willingness to supply the username and password stored on one page on a domain to another page on a domain.

Story

[Rasheed187]

This is quite a serious bug, not? And is it that hard to avoid these kind of programming errors?

[nadirah]

I think you can set firefox to not remember any passwords and other personal details etc etc....

[AWorriedPerson]

But does it affect my passwords if I have installed Firefox in my computer, but I use Internet Explorer for sites with password?

[Robyn]

If you are running IE7 it is open to the flaw too

Both the Mozilla Foundation's Firefox 2 and Microsoft's Internet Explorer 7 web browsers are vulnerable to a flaw that could allow attackers to steal passwords.

http://news.zdnet.co.uk/security/0,1...9284818,00.htm

[AWorriedPerson]

But if I use Internet Explorer 6, then my passwords are secure? So I should not download Internet Explorer 7?

I downloaded Mozilla Firefox 2.0 but I never used it because I saw this topic. But during installation process it asked if I would transfer information to Mozilla Firefox 2.0 from Internet Explorer. I did and now I have a fear that one password that was saved to remember in Internet Explorer is now known to some other person.

[Mrkvonic]

Hello,
No need to worry.
Your passwords may be stolen if:
1. You save them in your browser - if you always click 'never' or 'not now' when prompted to save the password, there's nothing to steal.
2. You need to visit a specially crafted page and be duped into interaction with content thereon to get potentially exploited.
Mrk

[AWorriedPerson]

Originally Posted by Mrkvonic

Hello,
No need to worry.
Your passwords may be stolen if:
1. You save them in your browser - if you always click 'never' or 'not now' when prompted to save the password, there's nothing to steal.
2. You need to visit a specially crafted page and be duped into interaction with content thereon to get potentially exploited.
Mrk

Thank you very much. That is really relieving to hear. Although I clicked once yes when prompted to save the password.

[Mrkvonic]

Hello,
You can delete saved passwords.
Mrk

[AWorriedPerson]

Originally Posted by Mrkvonic

Hello,
You can delete saved passwords.
Mrk

Could you explain me how to do it, please? I think I was able to do it by saving a false password instead the right, but I am not sure did it work correctly.

[ronjor]

In Firefox, go to the top menu, tools, options, security, show passwords. You can remove them from the window.

[Mrkvonic]

Hello,
Well, ronjor was faster....
Mrk

[AWorriedPerson]

Originally Posted by ronjor

In Firefox, go to the top menu, tools, options, security, show passwords. You can remove them from the window.

Thank you very much. I know this is not this topic but could you tell me please, how to do it in Internet Explorer too?

[Mem]

For IE7 Tools->Internet Options-> General-> Browsing History Delete-> Delete All or Delete Passwords

[ronjor]

For IE6, tools, Internet options, content, click auto complete, click clear passwords.

[AWorriedPerson]

Thank you all very much for your help.