Dave Naffziger's Blog

There were two unrelated things today that prompted this post:

1. Firefox 2.0 Password Manager Exploit
2. A great post on how to recover forgotten (but still stored) passwords.

Firefox Password Exploit

As I understand the poorly written vulnerability summary: you can have all of your passwords stolen if you visit a trusted site (trusted = you have a password saved there). This can be done without your knowledge. The places to be cautious are forums, blogs, myspace, etc. where users can affect the web page.

Recovering Lost Passwords:
Last time my dad forgot his Comcast email password, the Comcast rep convinced him that he needed a new account. They did re-setup Outlook Express for him, but in doing so they deleted his email store.

The tool, Cain and Abel, is a fairly sophisticated program that can help dig passwords (and plenty of other things) out of network traffic. It is worth noting that it only works with Ethernet adapters (no wireless), so you’ll need to convince Dad to plug in to make any use of this. I found it very easy to set up and run and was able to test sniff an FTP password in under five minutes.

And how many people are searching for ways to steal passwords?

I frequently test search volume for keywords when I stumble upon something that I hadn’t thought about in the context of SEO. I find it gives me a good perspective about the general interest level in the topic. Check out the keyword discovery stats for the top 20 ‘password’ terms:

To put this in perspective, the same number of people that searched for “password crackers” also searched for “hp computer”. It’s a hostile world beyond the firewall…