Re:Firefox Master Password System Has Been Poorly Secured fo...
by mattcoles on Monday March 19, 2018 @08:33AM
(#16617856)
Since Firefox is open source, instead of just waiting for Mozilla engineers to get around to it, couldn't someone just open a pull request?
[ Parent
| on HN ]
Re:Firefox Master Password System Has Been Poorly Secured fo...
by s_gourichon on Monday March 19, 2018 @09:24AM
(#16618139)
Sure. Could you just write a patch implementing the solution? I'll then open a pull request submitting your patch, to save you some work. ;-)
In practice, this only works if you provide the password manager that will be chosen once and for all.
zaarn's suggestion "providing an interface for password managers" is an interesting alternative.
Re:Firefox Master Password System Has Been Poorly Secured fo...
by mattcoles on Monday March 19, 2018 @09:41AM
(#16618250)
Haha, it was just the attitude I'm seeing suggests that we're somehow at the behest of Mozilla engineers and we just have to wait, but that's one of the great benefits of open source, we really aren't.
And I haven't looked but I imagine changing the encryption algo isn't a huge task, I wasn't suggesting that a non-Mozilla worker implement something huge like zaarn's suggestion, which fwiw I think is awesome as I don't use FF built-in password manager and find it just gets in the way.
Re:Firefox Master Password System Has Been Poorly Secured fo...
by hartator on Monday March 19, 2018 @09:59AM
(#16618364)
My guees would be changing the algo is trivial, but insuring smooth upgrades is not.