How to get Firefox to remember password after "never remember" was selected?

Question

I frequent a website that requires log in. I selected to have Firefox never remember the password as I store them in a password safe, but find this website is frequented so often I would like to have it auto filled. How can this be changed? Also how insecure is Firefox's password manager, to my understanding it's unencrypted and all add-ons could in theory access it?

Answer 1

How can this be changed?

Visit Preferences → Security → Remember logins → Exceptions. Remove your site from the list.

Also how insecure is Firefox's password manager, to my understanding it's unencrypted and all add-ons could in theory access it?

Firefox add-ons could access it regardless of encryption. After all, Firefox itself must decrypt it in order to actually fill in forms... I've seen legitimate extensions making use of this ability for synchronization or import/export; Mozilla Weave (now called Firefox Sync) initially was an addon.

(Though I'm assuming that WebExtensions will be considerably less powerful than the current Firefox XPI extension system.)

Either way, encryption is only useful for protecting the passwords at rest (it cannot guard against Firefox itself), and only if there's some way to securely store the master encryption key.

For the latter, Firefox would need to either ask you for the password, or ask the OS to protect the stored data. I think it avoids doing the latter in order to keep 'profiles' portable across computers and operating systems. (Also, if Firefox could ask the OS to decrypt the database, other programs could just do the same.)

So you're left with only two choices: no encryption at all, or activate the Use a master password option which encrypts all data with the given password. (As far as I know, 3DES-CBC is used by default.)