9 replies to this topic

[Fey]

I just found out that when you click "remember password" in Firefox (and internet explorer, and Google Chrome) that you can have that information remotely accessed by someone else.
While I realize most of those here probably already know that - I thought I would post a heads up for those who don't.

The reason that I mention this here, is because I picked up the suggestion from someone on these boards to use Firefox to remember your passwords and pin numbers for you so that even if you got Key Logged you would be able to just hit enter without having to type things in and thus give away that information. I have changed all of my important passwords and will stop using Firefox to remember them.

Though if I am making a mountain out of a molehill somebody please let me know - I only found out about this because of the funky Firefox Remeber Password for User "number here" message that was popping up every time I changed my passwords or entered a pin.

[Noitidart]

Hmm that stuff is stored on your hd but it shouldn't be accessible remotely. I know you can view it in plain text via your browser but that's the only way. If you get the file that stores its a bunch of gibberish I thought.

[Fey]

Not being a hacker, I wouldn't know.
All I know is that I found information in several places that explained how it could be done.
I didn't understand it - but as I said, I'm not a hacker.

Hmm that stuff is stored on your hd but it shouldn't be accessible remotely. I know you can view it in plain text via your browser but that's the only way. If you get the file that stores its a bunch of gibberish I thought.

[Kway]

The remote attack would have to go through the browser because I know Chrome has each profile encrypted based on the computer and user name. If you attempt a copy and paste to another account, all they would get is your bookmarks, cookies, localstoarge, temp, and usernames of your stored passwords (the encryption from the new location will return garbage data for the passwords and will automatically be wiped and have to be filled in by hand). This making transferring information annoying but better safe than sorry.

[hello123]

Firefox stores the passwords as MD5 Hashes. No longer the most secure, as certain strings of letters can result in the same MD5 hash (hence hashlists becoming more and more prevalent.

Hashing and encryption are 2 different stuffs. And password hashing with MD5 up to date is considered very secure, why wouldn't it be secure? The chances of MD5 string collision is like very low, it's like one in a billionssssss chance of having string collision. Password hashing with MD5 is not really vulnerable to the crypto collision attack. Unless your password is a dictionary word, else cracking the MD5 hash is almost impossible as it takes years to bruteforce it. And it's not possible to use MD5 hashing method to save the 'saved password' plaintext. Because it would be almost impossible for Mozilla to reverse it, unless they keep a reference of the plaintext to the hash key somewhere, which is pointless in this way since then they cannot really 'remember' the password, but just returning the hash of the plaintext which would be invalid password lol. Therefore they are using some encryption method to ENCRYPT the password, so that it can be reversible if only they have the 'key' to decrypt it.

Anyway, Firefox doesn't hash the saved password with MD5. It only encrypts/decrypts the password using the key3.db file. key3.db is the file that holds the key to encrypt and decrypt the password in plaintext. However the decryption process can be done easily under the Security tab options easily in Firefox.

Back to topic, I don't think there is any remote attack on stealing key3.db and signons.sqlite file which stores your username password. Unless you are infected with some backdoor virus or someone did a remote buffer overflow attack on you to plant backdoor, which I don't think it worth the time to do it. Most probably what you should concern about that is just local security issues instead of remotely.

Edited by hello123, 05 January 2011 - 08:03 AM.

[hello123]

Actually if you look into it, MD5 on it's own is no longer considered secure for password storage. If the MD5 hashes are uniquely salted, then yes it's secure but on it's own, whilst chances of collision are LOW it does exist. Go look up password hashes and hashlists. For 'good' passwords (which would be unlikely to be cracked anyway) MD5 should be more than sufficient.

If MD5 hashing WAS very secure, why would Mozilla have wiped the passwords of a large number of users when a bug resulted in a hashlist of their stored MD5'd passwords being posted (look it up, it happened). I concede on the point regarding how Mozilla stores it's passwords and got myself mixed up regarding the issue with Mozilla posting the hashes.

And yes, I realise hashing and encryption are 2 different things. Hashed strings cannot be 'decrypted' as such. When hashed passwords stored in a database, the method of verifying that information is to hash it then compare the matched hashes. This would obviously not work for a 'Remember Me' form as the submitted information would obviously need to be the unhashed string.

We both however agree wholeheartedly that users shouldn't be too concerned about 'remote' access of their stored passwords... unless they were extremely lax in their security, which if they were, would result in more issues then Neopets stuff being stolen.

anyways, @ 2am and work in 5 hours, I am off to bed.

-POST CITED FOR INCORECTNESS

They wiped the whole MD5 hash because it is been leaked. If not they wouldn't need to wipe the passwords. If the MD5 hash isn't leak in the first place, it would still be quite secure using it. You would probably just need to worry that your password is a dictionary word or that is in some record of MD5 rainbow table. If not it would be quite safe. Just that it is easier to be cracked, or rather say bruteforce to get the same hash doesn't means that it's unsafe. It's just easier to be cracked compared to SHA-256 or SHA-512 which is a lot harder since it has more key bits. Of course, salting the MD5 would make it much more secure, however unsalted MD5 for Mozilla case is also consider reasonably secure as cracking a MD5 hash is almost impossible unless your password just sucks lol. The flaw of collision attack in MD5 just reduce the number of possibilities for a bruteforce attack to be carried out, but carrying one to decrypt one of it with bruteforce attack (not to compare it with rainbow table attack or dictionary attack since this won't work if the hash is not in the record of the dictionary or rainbow table) would take months to years to a few lifetime to crack it. It is like 'no one would really waste the effort to do it'. Oh anyway, the string collision would only be a problem for if the string to be hash is damn long, then it would have string collision. Example - For a 20 length password, there still wouldn't be any collision with any 1 - 19 length password, and it would already take a few hundred or thousand of years to bruteforce the hash already.

-POST CITED FOR INCORRECTNESS

[equitatus]

I do remember password anyway.
I figure the chance of hacker is so low the tiresome duty of always having to type your pass and pin outweighs it,