902776 - vulnerability: hacking saved passwords in Mozilla firefox.

Status: RESOLVED DUPLICATE of bug 394533

(Firefox :: Untriaged, defect)

Description

[RAJAT JAISWAL]

Attachment: firefox-hack.jpg

User Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.2; MASPJS)

Steps to reproduce:

1. Open Firefox Web Broweser

2. Then Click on F3.
3. Then a POP Up box will appear, In that go to security and click on Show Passwords as show below.
 4. Now click on website whose password you want to see ans click on show password as shown in below image. (Note: It will ask for confirmation so click on yes when dialog box appears)


Actual results:

5. Done, You have hacked password of your victim with few simple steps. You can try this at school computer lab if someone have saved their password. 


Expected results:

anyone can become a major victim of this.

Comment 1

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

This is by design, and why we give the recommendation that users should use a master password, not store passwords on public computers and not give access to your computer by untrusted parties.