4 ms·

why isn't "Saved Passwords" and "Saved Search and Form data" separated between containers? There have been autofill/form-data attacks in the past[0] and there

why isn't "Saved Passwords" and "Saved Search and Form data" separated between containers? There have been autofill/form-data attacks in the past[0] and there was a story recently on HN's front page showing the same[1]. I'd like to point out that mozilla already has a configuration option to disable form data saving on https sites, 'browser.formfill.saveHttpsForms'. Why?[2] > Right; the idea is to eliminate "opportunism". If my laptop is stolen, Firefox's current behavior makes it easy for a thief to find a https: site in my history, go to it, check out, and then just let autocomplete hand them my complete credit card details. [0] https://news.ycombinator.com/item?id=12171547 https://news.ycombinator.com/item?id=12171547 [1] https://news.ycombinator.com/item?id=13329525 https://news.ycombinator.com/item?id=13329525 [2] https://bugzilla.mozilla.org/show_bug.cgi?id=252486 https://bugzilla.mozilla.org/show_bug.cgi?id=252486

Timshel 10y ago
Probably because of usability, they are still exploring how to integrate it in the browser (it will probably stay hidden behind a pref for a while). Right now no configuration screen is aware of the container feature.
- masklinn 10y ago
  Yeah usability is a toughie, an other feature I'd be interested in would be some sort of container inheritance (e.g. sub-identities in a work context when clients provide office 365 identities or to test projects under different identities all within the broader work context) but that's even harder to make easy to use.
wilde 10y ago
If the attacker has physical access to your machine, you have bigger problems. They can just read the autofill DB at that point.
giancarlostoro 10y ago
I also wish it was toggable to make history dependant on a container. My personal history will likely grow and have too much garbage, it would be nice to wipe it and have it not affect my work container.
Sylos 10y ago
The vulnerability described in your second link doesn't actually work in Firefox...

Timshel 10y ago

Probably because of usability, they are still exploring how to integrate it in the browser (it will probably stay hidden behind a pref for a while). Right now no configuration screen is aware of the container feature.

masklinn 10y ago
Yeah usability is a toughie, an other feature I'd be interested in would be some sort of container inheritance (e.g. sub-identities in a work context when clients provide office 365 identities or to test projects under different identities all within the broader work context) but that's even harder to make easy to use.

wilde 10y ago

If the attacker has physical access to your machine, you have bigger problems. They can just read the autofill DB at that point.

giancarlostoro 10y ago

I also wish it was toggable to make history dependant on a container. My personal history will likely grow and have too much garbage, it would be nice to wipe it and have it not affect my work container.

Sylos 10y ago

The vulnerability described in your second link doesn't actually work in Firefox...