Hacker News new | ask | show | jobs
by db48x 2077 days ago
Both Firefox and Chrome store passwords in an obscured form but not encrypted. In Firefox you can set a master password which causes the passwords to be encrypted for storage. Of course then you have to enter the master password in order to use the stored passwords, so most people don't bother. I assume that Chrome does something similar.

This means that it's not hard for either browser to use the passwords stored by the other. In fact, it means that any program running on your computer can recover those passwords, so you should exersize some care when choosing programs to install, or set a master password so that the passwords are encrypted.

1 comments

Very true, and I agree there are programs to retrieve browser passwords [1]. Does this mean there is built-in code in Firefox which sniffs for browser-stored password files inside home directory of a user? I don't see any other way how Firefox knew that I had the logins saved in Chromium for the particular site I mentioned.

[1] https://www.nirsoft.net/utils/web_browser_password.html

It doesn't have to "sniff" for anything; Chrome's user profiles are stored in a well-known location. Firefox's user profiles are as well. All it has to do is check to see if any Chrome user profiles exist.