Language Selection

English French German Italian Portuguese Spanish

Password Management Concerns with IE and Firefox

Filed under
Security

This two-part paper presents an analysis of the security mechanisms, risks, attacks, and defenses of the two most commonly used password management systems for web browsers, found in Internet Explorer and Firefox. The article specifically addresses IE 6 and 7 and Firefox 1.5 and 2.0. Attention is devoted to the following areas:

  • Password storage mechanisms: The means of safeguarding usernames and passwords on the local file system through encryption (addressed in part 1).

  • Attacks on Password Managers: The methods of subverting or bypassing safeguards (partially addressed in part 1; continued in part 2).
  • False sense of security: Users employing password managers without any awareness of the risk factors (discussed in part 2).
  • Usability: Features that enhance or deter the usability of security features (discussed in part 2).
  • Mitigation and Countermeasures: Actions that can be taken by users and corporations to reduce the risk (part 2).

Internet Explorer and Firefox together amass roughly ninety-five percent of all browser market share. [ref 1] AutoComplete [ref 2] and Password Manager [ref 3] are the features that store web form usernames, passwords, and URLs for Internet Explorer (since version 4), and Firefox (since version 0.7), respectively.

Each browser has helpful features to aid the user from being tasked with remembering different usernames and passwords as a means of authentication for web sites. Thus when navigating to a URL such as http://www.gmail.com where form input fields are present, both IE and Firefox will prompt the user if he or she wants to save their username and password. When the user re-visits the same web site the browser will automatically fill the fields.

Although these features greatly simplify the responsibility of the user, they also introduce security considerations that are addressed in the next few sections.

Part One
Part Two

More in Tux Machines

A look at Peek screen recorder for GNU/Linux

Have you ever found yourself wanting to record something on your screen for a few moments, to show someone else? I’m not talking videogame streaming or anything on that big of a level, but rather more the need to show someone where to find a menu item, or how to change a configuration setting, or other similar examples. If so, Peek could become your new best friend, for recording GIFs or other silent videos of what's happening on your screen. Peek is likely the most simplistic tool I have ever used for this purpose, but I don’t say that in a bad way, if anything it makes it even more of a pleasure to work with. Read more

Fedora 28 Coming Soon

Ubuntu and Derivatives

Red Hat Enterprise Linux 6.10 Enters Beta with a Focus on Security and Stability

In an attempt to continue to deliver upon Red Hat’s 10-year lifecycle support, Red Hat Enterprise Linux 6.10 entered beta stages of development today with a focus on improving the security and stability of the operating system, as well as to add support for the latest hardware and software components, and support the next generation of cloud-native apps. "With a focus on stability and security features that maintain hardware, application, and management tooling compatibility, Red Hat Enterprise Linux 6.10 Beta is designed to support the next generation of cloud-native applications through an updated Red Hat Enterprise Linux 6 base image," said Red Hat in today's announcement. Read more Also: Red Hat Enterprise Linux 6.10 Enters Beta