Firefox Is Determined to Password-Protect All Your Passwords. Can You Trust It?
Mozilla seems to have a pretty clear strategy when it comes to Firefox's development. Over the last few years, the browser went through a couple of major changes, which brought a more contemporary interface and plenty of performance improvements, but the emphasis has always been on users' privacy and security. Firefox's built-in password manager, for example, has received special attention.
It was given a proper name, Firefox Lockwise, and Mozilla implemented a feature that allowed users to synchronize login data across all mobile and desktop devices. The Firefox Monitor feature lets users automatically check their email addresses against Troy Hunt's HaveIBeenPwned data breach notification service, and the browser now comes with a built-in password generator. It looks like Mozilla is taking yet more steps to try and make Firefox Lockwise a serious alternative to the dedicated password management applications.
Firefox enables password protection on all the passwords it stores
Firefox has had a built-in password manager for years, but initially, it was doing nothing to protect the data stored in it from attackers who have physical access to the victim's device. Viewing or using a password was a matter of a few clicks of the mouse. At one point, Mozilla realized that they need to do something about it, which led to the introduction of a mechanism that is remarkably similar to what people get with standalone password managers.
The Firefox Master Password functionality is still present, and if you turn it on, you'll need to pick a master password which you'll enter every time you want to use the login data saved in your browser. It's a tried and tested protection mechanism, and as long as the master password is good enough, it should work fine. The trouble is, when it introduced it, Mozilla decided to leave it turned off by default, and although it's been around for a while now, many people don't even know about its existence. If everything goes according to plan, this will soon change.
Scheduled to come out on May 5, Firefox 76 should come with the Master Password feature turned on by default. If you haven't done so already, you'll be urged to pick a Firefox master password which will protect your personal data. If you prefer not to create a Firefox master password, you'll be asked to enter the password or PIN for your operating system when you want Firefox to auto-fill a login form for you, which is more or less how Google Chrome has treated the problem for the last few years. The mechanism will be available on Windows, macOS, Android, and iOS, and biometric authentication support should give users faster access to their data.
Trading usability for additional security
Some people might not be that happy with the changes, and it's not too difficult to see why. Even if biometric data is used, the update will create an additional step during the login process, and from a usability perspective, this doesn't seem like the wisest of moves. It does bring additional security, however, and it serves as yet more proof that the browser vendor is focused on protecting its users. But does that mean that you should trust all your login data with Firefox?
Security experts have advised against storing your passwords in a browser for years because a number of banking and information-stealing trojans have been able to pilfer all sorts of data from them. Firefox has made quite a few improvements to its password manager, but it still hasn't convinced the specialists. It's by no means the worst way of storing passwords, but dedicated applications can give you more flexibility and a wider range of security features.
Ultimately, you're the one who should decide how you want to store your data. Be sure to weigh the pros and cons of all the different options you're offered before you commit to any one of them, though. After all, your entire online presence could be dependent on a single decision.
