Firefox: Security Flaw or User Error?

I first started using Mozilla’s Firefox about three years ago. I was tired of all the problems I ran into using Microsoft’s Internet Explorer(IE) and was ready for something that worked. I didn’t know it at the time, but after exploring all that Firefox has to offer, I know I will never go back.

If by some chance you have been living under a rock for the past four years and don’t know what Firefox is you can check it out here. I can guarantee you won’t regret making the switch. However, the point of this article is not just to praise Firefox—there’s already too many people who have taken care of that. No, this article was created to shed light on what a colleague of mine considers to be a security flaw. In my opinion it is more a matter of user error, but unless the user is made aware of the risk—who is at fault?

Think for a moment about the number of websites that you have had to sign up to in your lifetime. If you’re like me, the number is quite high. Now imagine that you had a different password for each website. This is a good practice in terms of security, but can become quite a hassle when required to type them in on a daily basis.

That is why Firefox has a built-in “Password Manager” which gives the user the ability to save their passwords. The “Password Manager” may not be a new feature when it comes to surfing the net, but it something the average user may overlook when narrowing down security risks.

Unless a master password is set, any password that is saved on the user’s computer can be accessed easily in Firefox’s options. This means, that with just a few clicks, someone could easily have access any site you have ever saved. How can this be prevented?

I have two solutions:

1. Set A Master Password
   1. Select TOOLS/…OPTIONS/…SECURITY in Firefox
   2. Find the section for PASSWORDS.
   3. Check the box next to “Use a master password”
   4. Enter a password you can remember—use the gage to tell password strength.
   5. Click OK
2. Set A Password When Away From The Computer
   1. If you don’t want to have to type a password in every time you login to a site, make sure you set a password anytime you are away from your computer.
   2. This is not a full proof solution by itself: it is advised to use both approaches if security is an issue.