Language Selection

English French German Italian Portuguese Spanish

Password Management Concerns with IE and Firefox

Filed under
Security

This two-part paper presents an analysis of the security mechanisms, risks, attacks, and defenses of the two most commonly used password management systems for web browsers, found in Internet Explorer and Firefox. The article specifically addresses IE 6 and 7 and Firefox 1.5 and 2.0. Attention is devoted to the following areas:

  • Password storage mechanisms: The means of safeguarding usernames and passwords on the local file system through encryption (addressed in part 1).

  • Attacks on Password Managers: The methods of subverting or bypassing safeguards (partially addressed in part 1; continued in part 2).
  • False sense of security: Users employing password managers without any awareness of the risk factors (discussed in part 2).
  • Usability: Features that enhance or deter the usability of security features (discussed in part 2).
  • Mitigation and Countermeasures: Actions that can be taken by users and corporations to reduce the risk (part 2).

Internet Explorer and Firefox together amass roughly ninety-five percent of all browser market share. [ref 1] AutoComplete [ref 2] and Password Manager [ref 3] are the features that store web form usernames, passwords, and URLs for Internet Explorer (since version 4), and Firefox (since version 0.7), respectively.

Each browser has helpful features to aid the user from being tasked with remembering different usernames and passwords as a means of authentication for web sites. Thus when navigating to a URL such as http://www.gmail.com where form input fields are present, both IE and Firefox will prompt the user if he or she wants to save their username and password. When the user re-visits the same web site the browser will automatically fill the fields.

Although these features greatly simplify the responsibility of the user, they also introduce security considerations that are addressed in the next few sections.

Part One
Part Two

More in Tux Machines

KDE Leftovers

  • Qt Creator 4.2.1 released
    We are happy to announce the release of Qt Creator 4.2.1. This is a pure bugfix release, and takes care of various important bugs.
  • KTextEditor depends on KSyntaxHighlighting
    Recently, the KSyntaxHighlighting framework was added to the KDE Frameworks 5.29 release. And starting with KDE Frameworks 5.29, KTextEditor depends on KSyntaxHighlighting. This also means that KTextEditor now queries KSyntaxHighlighting for available xml highlighting files.
  • [Krita] Interview with Adam
    Good day. My name is Adam and I am a 26-year-old person who is trying to learn how to draw…
  • [Krita] We’re doing a User Survey!
    While we’re still working on Vector, Text and Python Scripting, we’ve already decided: This year, we want to spend on stabilizing and polishing Krita!

More of today's howtos

Linux and Graphics

ASUS "Tinker Board"

  • Asus takes on Raspberry Pi with 4K-capable Tinker Board
    Tech giant Asus is taking on the Raspberry Pi with its own DIY-friendly single-board computer that's said to offer 4K video playback and 24-bit audio support in exchange for a hefty £55 price tag.
  • ASUS "Tinker Board" Powered By Rockchip ARM SoC, Supports Debian
    Making its rounds this morning as a "Raspberry Pi competitor" is the Tinker Board from ASUS. The Tinker Board is ASUS' take on an ARM SBC similar to what's already offered by a plethora of vendors. The Tinker Board features a quad-core 1.8GHz ARM Cortex-A17 processor with ARM Mali T764 graphics and there is 2GB of DDR3 memory.