Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

This little button is the scariest thing in Firefox as far as I'm concerned:

enter image description here

I realize that passwords saved in web browser must neccearilly be stored insecurely, usually with a reversable hash, but most people don't know how to reverse this. I'm really worried about a friend, family member, or a co-worker on my computer just going in there and seeing my passwords -- it'd be trivial for them to do. Is there any way to at least hide this button?

share|improve this question

5 Answers 5

If you set a master password you'll be prompted to enter it before it will show you the saved passwords. Seems like an easier solution than always having to do a custom chrome.

share|improve this answer
    
Yeah, but then you still have to type in a password all the time. It's convinient to have the management, but I'm just lazy. –  matthews Jul 24 '09 at 13:58
6  
Then you're passwords are still accessible. I'd just need to visit your banking site from your browser and inspect the auto-populated password field with FireBug. –  Matt Jul 24 '09 at 14:03
    
If you're that far, you might as well just log in and mess with the money right there! –  Travis Jul 24 '09 at 14:23
up vote 6 down vote accepted

The best way I've found to hide this button is to create a custom userChrome.css file for Firefox. First, find your Firefox profile folder:

Vista/7: C:\Users\USERNAME\AppData\Roaming\Mozilla\Firefox\Profiles\SOMETHING.default
XP: C:\Documents and Settings\USERNAME\Application Data\Mozilla\Firefox\Profiles\SOMETHING.default
Mac OS X: /Users/USERNAME/Library/Mozilla/Firefox/Profiles/SOMETHING.default Linux/Unix: /home/USERNAME/.mozilla/firefox/SOMETHING.default

(more info on finding this at a MozillaZine Knowledge Base article)

Then go into the "chrome" folder. In here make a plain text file called "userChrome.css". Put the following into this file:

#showPasswords, #security-view-password { display: none; }

This will hide the "Saved Passwords" button in the Firefox preferences. I've gone so far as to set this userChrome.css file to hidden to make it less obvious that this is how I've hidden that button.

Obviously this is not fool proof. With enough time and effort, someone could still get into your passwords for instance by changing or removing the userChrome.css file. Still, it beats just leaving the door wide open.

share|improve this answer
1  
Combining this with the Master Password option would be the safest route. –  MiffTheFox Jul 25 '09 at 3:39

You can set a master-password. If a master-password is set, you'll need to enter it when you want Firefox to remember your password and when clicking the "Show Passwords" button.

you can read more about it at here

share|improve this answer

Even if you do disable the password reader, a malicious user can just use a third-party cracking utility to read your passwords without even launching Firefox. (source)

Your best bet is not storing any passwords at all in Firefox, and using an external solution to manage password-protection.

share|improve this answer
    
I know this, but even a terribly naive user can access passwords with Firefox's default settings. Most people don't have the skill to know about cracking utilities, and even among those that do most don't have the time -- going into Tools -> Options -> Security -> Saved Passwords -> Show Passwords takes mere seconds. –  matthews Jul 25 '09 at 3:48

I would not recommend just merely "hiding" something.

Like suggested, use the master password feature.

Alternatively, manage your personal passwords with a password database like Keepass. It is OSI (open source) certified and in my opinion the best password safe (for the Windows platform).

Of course, when accessing your password database, you need to enter your personal master password.

There is no shorter way, anything else is security by obscurity, which basically means no security at all.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.