Recently I have tried to clear my browser history and stumble upon a problem in the Firefox browser. I noticed that I could not able to clear data from firefox lockwise.
I uninstalled it and re-installed it. No changes. I never set my master password and that was a problem. Of course, it’s a security risk and sensitive information can be leaked or misused those who are on my computer or devices I synced with.
Here I wanted to point out two threats :
- If you haven’t set your master password and you are login to sync your browser history and everything will follow on the devices and if you forgot to kill the session than your credentials are at the risk.
- Even if you have just set a master password and forgot to kill session from your work computer and you got fired or died or worse your machine’s hard drive was replaced or whatever you think of. Now intruder needs to crack only one password to discover already synced offline data. (Kaboom…)
Now, what is the solution for this?
- Always kill your sessions after use and make sure you use a deadly Pass-phases, not a strong password. A strong password is a myth so strong pass phases should be 45 to 50 characters long and easy to remember it’s like a rhyme. But bloody hard to reverse it.
- Now, do you really need to keep login to sync? If yes, ask yourself why? and what are the consequences and how you can avoid them?
- Use only one password manager to avoid duplicates.
- Disable save password from about:preferences#privacy if you are using any password manager.
Let me tell you to try to clear all the saved credentials from Lockwise, I had 870 logins saved and it was not safe either. So I found a way to clear it out. And I would like to share with you.
Go to this site https://support.mozilla.org/en-US/kb/reset-your-master-password-if-you-forgot-it
Or just paste the following link
chrome://pippki/content/resetpassword.xhtml
And follow it. Did it work? Nooooo… I know its broken.