7

This little button is the scariest thing in Firefox as far as I'm concerned:

enter image description here

I realize that passwords saved in web browser must neccearilly be stored insecurely, usually with a reversable hash, but most people don't know how to reverse this. I'm really worried about a friend, family member, or a co-worker on my computer just going in there and seeing my passwords -- it'd be trivial for them to do. Is there any way to at least hide this button?

Improve this question

5 Answers 5

Reset to default
9

If you set a master password you'll be prompted to enter it before it will show you the saved passwords. Seems like an easier solution than always having to do a custom chrome.

Improve this answer
3
  • Yeah, but then you still have to type in a password all the time. It's convinient to have the management, but I'm just lazy.
    – スーパーファミコン
    Commented Jul 24, 2009 at 13:58
  • 6
    Then you're passwords are still accessible. I'd just need to visit your banking site from your browser and inspect the auto-populated password field with FireBug.
    – Matt
    Commented Jul 24, 2009 at 14:03
  • If you're that far, you might as well just log in and mess with the money right there!
    – Travis
    Commented Jul 24, 2009 at 14:23
7

The best way I've found to hide this button is to create a custom userChrome.css file for Firefox. First, find your Firefox profile folder:

Vista/7: C:\Users\USERNAME\AppData\Roaming\Mozilla\Firefox\Profiles\SOMETHING.default
XP: C:\Documents and Settings\USERNAME\Application Data\Mozilla\Firefox\Profiles\SOMETHING.default
Mac OS X: /Users/USERNAME/Library/Mozilla/Firefox/Profiles/SOMETHING.default Linux/Unix: /home/USERNAME/.mozilla/firefox/SOMETHING.default

(more info on finding this at a MozillaZine Knowledge Base article)

Then go into the "chrome" folder. In here make a plain text file called "userChrome.css". Put the following into this file:

#showPasswords, #security-view-password { display: none; }

This will hide the "Saved Passwords" button in the Firefox preferences. I've gone so far as to set this userChrome.css file to hidden to make it less obvious that this is how I've hidden that button.

Obviously this is not fool proof. With enough time and effort, someone could still get into your passwords for instance by changing or removing the userChrome.css file. Still, it beats just leaving the door wide open.

Improve this answer
2
  • 1
    Combining this with the Master Password option would be the safest route.
    – MiffTheFox
    Commented Jul 25, 2009 at 3:39
  • It looks that this is not working anymore in recent versions of Firefox (currently using 41.0), most probably since the Options window has been redesigned in the about:preferences tab.
    – Otiel
    Commented Sep 27, 2015 at 20:44
2

You can set a master-password. If a master-password is set, you'll need to enter it when you want Firefox to remember your password and when clicking the "Show Passwords" button.

you can read more about it at here

Improve this answer
0

Even if you do disable the password reader, a malicious user can just use a third-party cracking utility to read your passwords without even launching Firefox. (source)

Your best bet is not storing any passwords at all in Firefox, and using an external solution to manage password-protection.

Improve this answer
1
  • I know this, but even a terribly naive user can access passwords with Firefox's default settings. Most people don't have the skill to know about cracking utilities, and even among those that do most don't have the time -- going into Tools -> Options -> Security -> Saved Passwords -> Show Passwords takes mere seconds.
    – スーパーファミコン
    Commented Jul 25, 2009 at 3:48
0

I would not recommend just merely "hiding" something.

Like suggested, use the master password feature.

Alternatively, manage your personal passwords with a password database like Keepass. It is OSI (open source) certified and in my opinion the best password safe (for the Windows platform).

Of course, when accessing your password database, you need to enter your personal master password.

There is no shorter way, anything else is security by obscurity, which basically means no security at all.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .