Firefox asked to import logins from Chromium

#1

Post by tug0fwar » Sat, Oct 17, 2020, 2:06 PM UTC

While I was logged into an AWS Educate account in a portable Chromium instance, I just opened Firefox (also a portable instance) and was asked to import the logins from Chromium 'for this specific site'. How does Firefox know I've saved logins for this particular website in another Browser?

Default browser is Edge, which I only use for 127.0.0.1:/ and pdfs (just to clarify things a little)

Re: Firefox asked to import logins from Chromium

#2

Post by db48x » Sat, Oct 17, 2020, 3:44 PM UTC

Both Firefox and Chrome store passwords in an obscured form but not encrypted. In Firefox you can set a master password which causes the passwords to be encrypted for storage. Of course then you have to enter the master password in order to use the stored passwords, so most people don't bother. I assume that Chrome does something similar.

This means that it's not hard for either browser to use the passwords stored by the other. In fact, it means that any program running on your computer can recover those passwords, so you should exersize some care when choosing programs to install, or set a master password so that the passwords are encrypted.

Re: Firefox asked to import logins from Chromium

#3

Post by tug0fwar » Thu, Oct 22, 2020, 2:49 PM UTC

db48x wrote: post #2

Both Firefox and Chrome store passwords in an obscured form but not encrypted. In Firefox you can set a master password which causes the passwords to be encrypted for storage. Of course then you have to enter the master password in order to use the stored passwords, so most people don't bother. I assume that Chrome does something similar. This means that it's not hard for either browser to use the passwords stored by…

Very true, and I agree there are programs to retrieve browser passwords [1]. Does this mean there is built-in code in Firefox which sniffs for browser-stored password files inside home directory of a user? I don't see any other way how Firefox knew that I had the logins saved in Chromium for the particular site I mentioned.

[1] https://www.nirsoft.net/utils/web_browser_password.html

Re: Firefox asked to import logins from Chromium

#4

Post by db48x » Fri, Oct 23, 2020, 12:54 AM UTC

tug0fwar wrote: post #3

db48x wrote: post #2

Both Firefox and Chrome store passwords in an obscured form but not encrypted. In Firefox you can set a master password which causes the passwords to be encrypted for storage. Of course then you have to enter the master password in order to use the stored passwords, so most people don't bother. I assume that Chrome does something similar. This means that it's not hard for either browser to use the passwords stored by…

Very true, and I agree there are programs to retrieve browser passwords [1]. Does this mean there is built-in code in Firefox which sniffs for browser-stored password files inside home directory of a user? I don't see any other way how Firefox knew that I had the logins saved in Chromium for the particular site I mentioned. [1] https://www.nirsoft.net/utils/web_browser_password.html

It doesn't have to "sniff" for anything; Chrome's user profiles are stored in a well-known location. Firefox's user profiles are as well. All it has to do is check to see if any Chrome user profiles exist.