Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I want Firefox to "remember" my passwords so I don't have to type them in; unfortunately, the built-in password manager stores them in plain text, which is too high a security risk. I'd like to find a secure way for Firefox to do basically the same thing. Though I've heard good things about LastPass and other such services, I'm not too comfortable entrusting them with my data; any of those companies could suddenly change their terms, start charging, or just go under. I love the idea of KeeFox, but alas, it's not available for Linux. Any ideas?

share|improve this question
7  
What makes you think Firefox is storing them plain text? Isn't there a master password to protect the password db? –  alex Dec 7 '10 at 12:12
    
is browser integration a requirement? or do you just want storage? also what desktop environment? –  xenoterracide Dec 7 '10 at 13:20
4  
Readers of this question may also be interested in How are browser saved passwords vulnerable?. –  Gilles May 12 '11 at 23:35
    
And also, independently of the way the passwords are stored, they are also very insecure because they may be viewed directly going to: Edit -> Preferences -> Security -> Passwords -> Show passwords. That option is with Firefox 3.x and also with Firefox 4. –  nozimica May 14 '11 at 6:58
3  
@nozimica You need to re-enter the master password to actually see the passwords if you go to Show passwords - of course, you need to set first the master password. –  jofel Mar 18 '12 at 19:01

7 Answers 7

You can encrypt and protect your Firefox passwords with a master password:

Preferences → Security → Passwords

Then check:

☑ Use a master password

Then set a master password.

share|improve this answer

I believe you are mistaken. When using the Password manager, Firefox does not store your passwords in clear text:

Firefox stores your password data in two files: key3.db (Master Password / Encryption key) and a "signons" file (encrypted names and passwords). You can back up your passwords by making a copy of both "Key3.db" and the "signons" file for your Firefox version. Firefox 2 uses signons2.txt, Firefox 3.0.x uses signons3.txt, and Firefox 3.5 and 3.6, including current Beta and nightly builds, use signons.sqlite. [4] See Profile folder - Firefox and Profile backup for additional information.

If you are concerned, you could enable encryption of your entire home directory as an added protection.

share|improve this answer

Depending what Desktop Environment you're using you could integrate Firefox with default password storage mechanism for this environment:

  • KDE - KWallet
  • GNOME - GNOMEKeyring

If you want integrate Firefox with KWallet you could use KDE Wallet password integration extension for Firefox. If you are GNOME user there is Gnome-keyring password integration extension (you need to modify it to install with newest Firefox version - instructions are in comments at the extension site).

share|improve this answer
    
Ooooh, great tip! –  Josh Dec 7 '10 at 13:29
    
by any chance does that kwallet extension exist for chrome do you know? –  xenoterracide Dec 9 '10 at 13:42
1  
I'm not even sure if it is possible - as I know Chrome API for extensions is less advanced that Firefox API... –  pbm Dec 9 '10 at 14:34

You can also enable FIPS Mode.

Enable it by: Preferences->Advanced->Encryption->Security Devices->Enable FIPS

You must have a Master Password set on your password database for this to work, but these are the settings we put in place here at the security company where I work. If we store passwords in the browser, then these two steps must be taken in order for it to be acceptable security-wise to the company.

For an explanation on FIPS 140-2, and why you'd want to do this:

https://developer.mozilla.org/en/NSS/FIPS_Mode_-_an_explanation

share|improve this answer

I don't know why keefox isn't running in linux, i havent looked at it yet. I'm securing my important files with encfs and fuse, because it doesn't need a block or loop device and encrypts file by file. http://www.arg0.net/encfs

share|improve this answer

I'm not sure if such a hackery method is the best approach, but I think in case we see any other program show such a behavior, this will be a good idea to create a link to a named pipe (in case you use Unix-like) with the same name as the file and encrypt the other head of pipe. So each time a write is done it'll be encrypted and decrypted when reading.

I think it could be handy at times, and I should say I haven't tested it yet (popped up into my mind suddenly).

share|improve this answer

Now there is addon KeeFox for Firefox for Linux.

Need to install all the mono packages:

aptitude install mono-complete

You need to download latest compatible with linux Version of KeePass FireFox Addon.

You will need to install PassiFox for FireFox and KeePassHttp for KeePass in order to connect KeeFox and KeePass (That is strange but it is working).

Configure KeeFox with directory to the KeePassRPC plugin.

/usr/lib/keepass2/plugins

and KeePass2 installation dir

/usr/bin
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.