Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I stored my passwords in firefox browser in the computer of a company I was doing internship with. I had my login for that computer, so no one could access it. I want to ask that as now I am gone, would anyone be able to access those passwords in that browser? Are browsers login specific?

EDIT: I already know how to crack or see the passwords on firefox for any personal computer, however I was asking it from the perspective of logins, which are person specific in companies. So except me no one else would be able to access that account - not even the administrator I believe, given the policies of a company on security. I just asked the tech people there and the guy said no one else except me would be able to access my browser and its contents, which itself is login specific. Those admins don't know the passwords and they don't have either permission or access to login to other person's account solely on their own. The admin does needs the person's help to log into his account to solve the problems of the account. So I'm assuming my account is kinda abandoned and will eventually reset whenever they format the machine.

share|improve this question
    
Have a look at my answer as well as go here superuser.com/questions/182090/… –  subanki Sep 7 '10 at 18:06
    
Can you explain how this login specific thing works .. I am a little dumb in this issue. If you are a domain user then why cant the administrator check and open your account –  subanki Sep 7 '10 at 20:02
    
@subanki: Please see my EDIT portion which clearly explains what you are asking. However the admin may or may not have permission to dig into the user account depending upon the policies of an organization. Like in most educational institutions admins can dig into user accounts without the knowledge of the user. –  Pupil Sep 7 '10 at 20:14
2  
But that are simple polices, a user if he wants cant he ignore the policy and do whatever he wants. I don't know if you are talking about polices enforced into the computer –  subanki Sep 7 '10 at 20:28
2  
that would be an unlikely situation, because, for example, if you died (sorry) or had amnesia they would have to access your account's contents somehow. Whatever that solution is can be abused. –  digitxp Sep 7 '10 at 21:48

5 Answers 5

up vote 4 down vote accepted

Super-duper-easy. Here are a few ways that they can:

  1. An admin for that computer can access your files, and since Firefox's password manager has no encryption, he/she could simply go into your profile folder and search in there.
  2. Anyone with a copy of Linux could do the same thing because Windows' user profiles are unencrypted. This is less likely because not many people know of Linux to begin with, not to mention that corporations tend to disable BIOS-y stuff on their computers.
  3. Somebody could've installed a keylogger. Unlikely because corporations (and any place with some decent security) has some decent antivirus.

Firefox's Password Manager is worse than storing passwords in a text file. Why? Because it gives you the false security that your passwords are encrypted when they aren't.

share|improve this answer
    
+1 for FF's Password Manager being "dangerous". While password fatigue is a pain, it pays to be over-cautious and never save passwords to anything vital in browser - it is often the weakest link. –  DMA57361 Sep 7 '10 at 18:09
    
+0.5, for forgetting EFS and full-disk-encryption. –  grawity Sep 7 '10 at 20:22
    
+0.5 because I cant make out what it is in your photo –  subanki Sep 7 '10 at 20:30
    
@grawity I didn't mention that because not all that many companies actually use that...very expensive. –  digitxp Sep 7 '10 at 21:46
    
@digitxp: EFS kind of comes with Windows... at least, in my Win XP Pro it does. One can encrypt his AppData\Mozilla\Firefox in a few clicks. (I'm less sure about its presence in various Win7 versions, however.) –  grawity Sep 8 '10 at 13:13

It is entirely possible that an administrator could gain access to your saved passwords. A normal user account on the system normally would not have permission to do so. As far as a browser being login specific, they are only login specific in the sense that a typical browser will store user-related data in that user's system profile.

share|improve this answer

Yes, If you didn't clear them

All Window Passwords are easily crackable. And many softwares to this are available in the internet. Even If you were the administrator of that computer any person who has a normal account can easily change your password and enter in as administrator.

To View those passwords

1) First of all load up Firefox

2) Look at the drop down menu called 'tools' up the top

3) In that menu, you will find an 'Options' button. Click it.

4) Up the top of your menu, you will find a security tab, with a padlock as it's icon. Click it.

5) Here you will see all of the passwords stored. If you want to look at the password, you must press 'Show Passwords'

Solution would be to Change all your passwords

share|improve this answer
    
He said he put it under a login, so that method to finding the passwords wouldn't work. –  digitxp Sep 7 '10 at 18:18

In firefox goto Tools> Options>Security> Saved Passwords> Show Password. My advice: change your passwords immediately.

share|improve this answer

Yes, any person with full access to the computer (including any sysadmins) can read Firefox' saved data. If you did not use a Master Password, then the passwords are stored unencrypted and can be read directly.

If you used a Master password, the passwords are encrypted. However, this is only really secure if you used a strong Master password. Strong means at least 60 bit, which would mean a password of 10 random (!) alphanumeric characters (a-z, A-Z, 0-9), e.g. something like "kqr4Ew7QwE". Any password significantly simpler can be cracked.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.