587547 - Passwords in clear text in FF password manager

Status: RESOLVED DUPLICATE of bug 259996

(Firefox :: Security, enhancement)

Description

[Murali Nallapaty]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.8) Gecko/20100722 Firefox/3.6.8

I stumbled across a potential security weakness in firefox. It may not be a bug but definitely a security weakness that can be disastrous.  When you store usernames and passwords in firefox, you can actually see them in clear text by going to tools-options-security-saved passwords. While I think it is a great convenience, if not managed properly it could be a security disaster.  Of course, you can protect it with master password but I think the ff should prompt the user for setting up a master password when the user chooses to save passwords.  Please consider this and let me know if I can help.  Thanks!

Reproducible: Always

Steps to Reproduce:
1. Try to login to a website that is secured with username and password
2. FF prompts for saving the password. 
3. Go to Tools-options-Saved passwords and hit display passwords.  All your passwords will display in clear text
Actual Results:  
Passwords displayed in clear text

Expected Results:  
Passwords to display obscured.

Comment 1

[Brandon Sterne (:bsterne)]

This isn't a bug that needs to remain hidden.