Language Selection

English French German Italian Portuguese Spanish

Password Management Concerns with IE and Firefox

Filed under
Security

This two-part paper presents an analysis of the security mechanisms, risks, attacks, and defenses of the two most commonly used password management systems for web browsers, found in Internet Explorer and Firefox. The article specifically addresses IE 6 and 7 and Firefox 1.5 and 2.0. Attention is devoted to the following areas:

  • Password storage mechanisms: The means of safeguarding usernames and passwords on the local file system through encryption (addressed in part 1).

  • Attacks on Password Managers: The methods of subverting or bypassing safeguards (partially addressed in part 1; continued in part 2).
  • False sense of security: Users employing password managers without any awareness of the risk factors (discussed in part 2).
  • Usability: Features that enhance or deter the usability of security features (discussed in part 2).
  • Mitigation and Countermeasures: Actions that can be taken by users and corporations to reduce the risk (part 2).

Internet Explorer and Firefox together amass roughly ninety-five percent of all browser market share. [ref 1] AutoComplete [ref 2] and Password Manager [ref 3] are the features that store web form usernames, passwords, and URLs for Internet Explorer (since version 4), and Firefox (since version 0.7), respectively.

Each browser has helpful features to aid the user from being tasked with remembering different usernames and passwords as a means of authentication for web sites. Thus when navigating to a URL such as http://www.gmail.com where form input fields are present, both IE and Firefox will prompt the user if he or she wants to save their username and password. When the user re-visits the same web site the browser will automatically fill the fields.

Although these features greatly simplify the responsibility of the user, they also introduce security considerations that are addressed in the next few sections.

Part One
Part Two

More in Tux Machines

Most popular web browsers among Fedora users

Google Chrome is the most popular browser in the world. It is so popular that some call it a new Internet Explorer. But that’s based on global stats. In Red Hat, I’m responsible for web browsers, so I wondered what are the most popular web browsers among Fedora users. So I asked through Fedora accounts on Facebook and Google+: “Which browser do you use the most in Fedora?” Read more

Life in a Post-Container World and Why Linux Will Play a Diminished Role

Containers have actually been with us since the late 1990s, but they are not the end of the story. The real transformation will come with a “serverless” future that will completely overturn the ops ecosystem. Companies will go out of business, new ones will spring to life, and thousands of people will have fundamental changes to their jobs. The shift to a serverless future is much bigger than your normal hype cycle — I believe the current container hoopla is a foreshock preceding a 9.0 quake. Read more

FFmpeg's Leader Resigns, Hopes To Make Libav Developers Come Back

Michael Niedermayer, the leader of the FFmpeg project for the past eleven years, has made a surprise announcement today: he's resigning as its leader. Niedermayer is resigning as he no longer feels he's the best leader for FFmpeg, given the current Libav fork still persisting even after Debian dropped Libav and is returning to FFmpeg. Read more

30 Sys Admins to Follow on SysAdmin Day

Systems administrators: They keep our high-tech world up and running. From capacity planning, to 3 a.m. phone calls, to retiring that 10-year-old server that uses more power than your whole house, sys admins do it all. Open source communities would not be able to thrive without the networks, services, and tools that allow for communication and collaboration, and sys admins are the ones who work thanklessly year-round to keep them going. July 31 is System Administrator Appreciation Day, a day for all of us to express our undying gratitude for sys admins. Sure, you could buy your favorite sys admin cake and ice cream, or perhaps a nice gift card. You could even go as far as not breaking the server for just one day. You also can follow these 30 sys admins. Read more