4 ms·

1. Browsers are expected to have password management of some sort. Firefox's existing one is rather inadequate from a UX and security standpoint, as recently di

by mastax 9y ago

1. Browsers are expected to have password management of some sort. Firefox's existing one is rather inadequate from a UX and security standpoint, as recently discussed. 2. Browsers need to be trusted and secure. If you use Firefox, you are trusting Mozilla et. al. to have the policies, procedures, motivations, and expertise to create secure software that protects your privacy. If you can trust them to make your browser, you can trust them to make your password manager. I do hope that Mozilla answers these questions directly when/before this moves out of beta.

lawl 9y ago
1. Yes but that doesn't answer the standalone question. 2. I do trust Mozilla to have the technical expertise to build a secure password manager. But just because they can do it, still doesn't answer why they're doing it the way they're doing it. I would just like to hear Mozillas thought process that went into this. I'm sure they have reasons for all decisions, but I can't read thoughts. Knowing their thought process would help me evaluate my prediction of this being abandon-ware in half a year.
josteink 9y ago
> Browsers are expected to have password management of some sort. Firefox's existing one is rather inadequate from a UX and security standpoint, as recently discussed. I'd like to see this discussion. For me, I find Firefox's password manager the only one I can bother using, because it offers a good and seamless UX, right where I need it. If they "fix" that by making it terrible like Lastpass, I honestly don't know what I'll do.
- akquise 9y ago
  > I'd like to see this discussion. Concerning the "security standpoint", probably this news [0] is meant. Hashing the password with SHA-1 using 1 iteration may be referred to as "inadequate". [0] https://www.bleepingcomputer.com/news/security/firefox-master-password-system-has-been-poorly-secured-for-the-past-9-years/ https://www.bleepingcomputer.com/news/security/firefox-maste...
  - mintplant 9y ago
    Maybe if the hash were actually being stored, as in a website's accounts database, but SHA-1 is being used here to normalize a variable-length user-supplied password into a fixed-length string which can be used as the key input to an encryption function. The article approaches this from an angle of an attacker with access to this hash bruteforcing it to obtain the original plaintext password. But as the hash is the encryption key, if an attacker were able to recover it from the encrypted password store blob, it would already be game over. Applying a more costly hash algorithm would increase the cost of generating guessed encryption keys in a bruteforcing scenario, strengthening weak passwords somewhat. But using a single SHA-1 iteration here doesn't weaken the password security model. A strong password will remain strong.
the8472 9y ago
> 1. Browsers are expected to have password management of some sort. Having a browser component that can be asked by other browser components to pretty please fill in some secrets seems like a way to increase your attack surface. With an external password manager and no integration there's no internal API to be exploited, short of compromising the whole user, or if you have some sort of application isolation, the whole system.
deleted 9y ago
[deleted]

by mastax 9y ago

lawl 9y ago

1. Yes but that doesn't answer the standalone question. 2. I do trust Mozilla to have the technical expertise to build a secure password manager. But just because they can do it, still doesn't answer why they're doing it the way they're doing it. I would just like to hear Mozillas thought process that went into this. I'm sure they have reasons for all decisions, but I can't read thoughts. Knowing their thought process would help me evaluate my prediction of this being abandon-ware in half a year.

josteink 9y ago

> Browsers are expected to have password management of some sort. Firefox's existing one is rather inadequate from a UX and security standpoint, as recently discussed. I'd like to see this discussion. For me, I find Firefox's password manager the only one I can bother using, because it offers a good and seamless UX, right where I need it. If they "fix" that by making it terrible like Lastpass, I honestly don't know what I'll do.

akquise 9y ago
> I'd like to see this discussion. Concerning the "security standpoint", probably this news [0] is meant. Hashing the password with SHA-1 using 1 iteration may be referred to as "inadequate". [0] https://www.bleepingcomputer.com/news/security/firefox-master-password-system-has-been-poorly-secured-for-the-past-9-years/ https://www.bleepingcomputer.com/news/security/firefox-maste...
- mintplant 9y ago
  Maybe if the hash were actually being stored, as in a website's accounts database, but SHA-1 is being used here to normalize a variable-length user-supplied password into a fixed-length string which can be used as the key input to an encryption function. The article approaches this from an angle of an attacker with access to this hash bruteforcing it to obtain the original plaintext password. But as the hash is the encryption key, if an attacker were able to recover it from the encrypted password store blob, it would already be game over. Applying a more costly hash algorithm would increase the cost of generating guessed encryption keys in a bruteforcing scenario, strengthening weak passwords somewhat. But using a single SHA-1 iteration here doesn't weaken the password security model. A strong password will remain strong.

the8472 9y ago

> 1. Browsers are expected to have password management of some sort. Having a browser component that can be asked by other browser components to pretty please fill in some secrets seems like a way to increase your attack surface. With an external password manager and no integration there's no internal API to be exploited, short of compromising the whole user, or if you have some sort of application isolation, the whole system.

deleted 9y ago

[deleted]