Auto login like LibreWolf for Firefox

sylver_dragon, 1 month ago

First and foremost: Do not save passwords in browsers.

Seriously, they all suck at it. I work in cybersecurity. Every time we see a workstation get compromised, one of the first actions the attacker’s scripts do is pull credentials from the browser. We had one just a couple weeks ago and the users had dozens of personal passwords compromised this way. Please, just don’t store passwords in your browser.

As another poster mentioned, BitWarden is great. I personally use KeePass. At least with Firefox, the Kee extension can let it autofill forms. I think BitWarden has something similar.

raker, 1 month ago

Exceptionally I’m looking for the fastest solution not the safest one without violating company security policies. I personally use KeePass, too. I’ll check out those extensions, thanks! One question: Browsers do not store credentials encrypted? Or too weak encrypted?

sylver_dragon, 1 month ago

They are encrypted and the encryption is just fine. The problem is that the key is stored locally on your system and can be used to decrypt them automatically. And crucially, that key is not encrypted, it’s just encoded in a well known format (base64). This means that it’s trivial for an attacker’s script to retrieve them, use that key to decrypt them and send them up to the attacker’s Command and Control (C2) server. As an analogy, imagine having the world’s best lock on your front door, but you have the key under your door mat. The lock counts for fuck all, because any thief who isn’t a complete moron will look under the mat.

You can actually see this in action for yourself, without your passwords being sent to an attacker. NirSoft has a tool called ChromePass which will retrieve and display passwords saved in Chrome. If I run this on my own system, I get something like:

https://lemmy.world/pictrs/image/de5de968-8979-4d40-b275-6e67c5938d94.png

And this works whether or not the browser is running. So, if you get phished, or get hit by an unpatched vulnerability, any password you have saved in your browser is now in the hands of an attacker. And this happens in the first few seconds of an infection. It only takes one mistake and they are gone. And, while we all like to think that we are immune to phishing or mistakes like that, we all fuck up. It happens. This is why we plan for “defense in depth”. Keeping your passwords out of a browser means that, when you make that mistake, they don’t end up in the hands of attackers.

raker, 1 month ago

base64

Wow! That’s not even encrypted O_0 Does every browser just “encode” password lists like that?

Bth NirSoft tools are just great. Lost passwords and many other things. Anyway, thanks for the infos!

sylver_dragon, 1 month ago (edited 1 month ago)

Does every browser just “encode” password lists like that?

It’s the decryption key for the encrypted passwords which is encoded (I know confusing). But, they may as well not be encrypted for all the good it’s doing you.

Off the top of my head, Chrome does this. MS Edge, which is Chrome with a blue coat of paint, does. Opera is Chrome with red paint, so it’s almost certainly base64 as well. Brave browser is Chrome with orange paint… You get the idea, lots and lots of “independent” browsers are just Chrome (ok technically, Chromium, the open source version of Chrome) which mean they inherit all it’s faults. I don’t know the scheme Firefox uses, but it’s similar enough that recovering passwords is equally as trivial. Here is the tool for that.

The long and short of it is that any system for storing passwords which doesn’t have you using some sort of “master password” to unlock the vault, is storing the password locally in a way which is going to be well known and easy for an attacker to reverse. Technically, hardware solutions like smartcards and YubiKeys can also be used in place of passwords; but, that’s a whole different area of discussion. Sadly, when things are really convenient, they are usually also really insecure.

raker, 1 month ago

Thanks again for all the insights!

lemmyreader, 1 month ago

LibreWolf is Firefox with privacy and security enhancements. If you want to you would be able to do the same in Firefox, unless your employer has disabled that. There’s Bitwarden extension for Firefox that does auto-fill. Signing up with Bitwarden for a free of charge account, or self host a Vaultwarden server. Are you allowed to run Docker on your workplace computer ?

raker, 1 month ago

Looking for a short way without involving inhouse IT department right now. I’ve used Bitwarden once long time ago and I will check it out again and those browser extensions. Thanks! Not sure about Docker. That would be for the Vaultwarden server?

lemmyreader, 1 month ago

Looking for a short way without involving inhouse IT department right now. I’ve used Bitwarden once long time ago and I will check it out again and those browser extensions. Thanks!

You can use two factor authentication with Bitwarden, and their passkeys implementation is in the works.

Not sure about Docker. That would be for the Vaultwarden server?

Yes, but easiest would be a sign up with bitwarden.com for a free or premium account.

velox_vulnus, 1 month ago

You might want to read this: Password managers. Bitwarden is a good solution.

raker, 1 month ago

Thanks! Will check it out. Addon recommendations by LibreWolf itself sounds nice. Most important addon is in any case uBlock Origin. No way around it. Also for security reasons, not just for ad blocking.