Store passwords securely in Firefox

Introduction

Most of us visit a lot of websites, and we have a need to login to many of these sites. We know that it would be a bad idea to use the same password for all online accounts, so we create unique passwords for each site. However, it is impossible for us to remember all of these passwords so we tell Firefox to remember them for us.

This provides great convenience, but it also creates a huge security risk. Anyone who sits down at your computer can view your passwords! If you don't believe me, try this in Firefox: "Edit" > "Preferences" > "Security" > "Show Passwords".

Fortunately, the smart people at Mozilla have created an improved way to store your passwords. This method requires creating a "Master Password" which is used to encrypt your online passwords. You can do this in Firefox by clicking on "Edit" > "Preferences" > "Security" and clicking on the button labeled "Use a master password".


When you are creating a Master Password, it is important that you create a strong password. Even though your passwords are encrypted, they can still be retrieved if someone can guess your Master Password. Someone has even created a password recovery tool called FireMaster that tries to find your password by using both dictionary and brute-force attacks.

Once you have created a Master Password, you will be asked for it the first time you try to login to an online account. Firefox will only ask for this password once per session . If you close and open Firefox you will need to enter it again.

If you are paranoid about this, there is also a Firefox extension that will force you to re-enter the Master Password after a certain length of inactivity. Of course, a simple screen-saver password would accomplish the same thing. ("System" > "Preferences" > "Screensaver" > "Lock screen when screensaver is active")

Feature Requests

A password generator would be useful when creating the master password and when creating new online accounts. Because your passwords are remembered by Firefox, you can get away with using highly complex passwords in all your online accounts. There is a Firefox extension that will help you generate secure passwords.

I also wish there was a way to easily synchronize my saved passwords on my work machine with my home machine, and my laptop. If I wanted to do this manually, I could install the Password Exporter Firefox extension which lets you export and import the passwords using encrypted text files. Google appears to have a great product to fill this need: Google Browser Sync. Just beware of the possible privacy and security risks of letting Google have access to your passwords, history, cookies, and favorites.