According to a message posted over the weekend on the Full-Disclosure mailing list, the latest version of Firefox, 2.0.0.5, contains a password management vulnerability that can allow malicious Web sites to steal user passwords. If you have JavaScript enabled and allow Firefox to remember your passwords, you are at risk from this flaw.

"You know that sick feeling you get in the pit of your stomach, the one that means either you forgot your mother’s birthday or even worse - your password for your favorite web site. Thankfully if Firefox has been remembering these passwords for you, recovering them in an easy task..."

Well that is OK then. No sooner has Mozilla updated Firefox to 3.0.2 and broken my saved passwords so they cannot be accessed, nor can I create new ones, than it announces it is 'working real hard' to get Firefox 3.0.3 out to fix the mess.

Somebody recently wrote in asking how to backup the list of saved passwords in Firefox into a spreadsheet, so I'm writing the solution here for everybody: All you need is the Password Exporter extension.

This article explains how to move a full profile (addons, themes, cookies, browsing history, passwords and so on) from Firefox 3.0.x to Firefox 3.1.x beta or any other version, but it also works for synchronizing Firefox on 2 different computers or backing up a full profile of Firefox.

For pidgin users, there is a security issue regarding storing passwords in pidgin, so this program stores the passwords in archives .xml in clear text without any encryption. So any one can easily boot into recovery mode while you are away and find all your passwords in plain text. Then he can just copy the password files and opps he will got all the passwords easy way.

Enforcing password security with a multiple-user system can be a hassle — users all too often use inadequate passwords. john-the-ripper (also available via most distros) is a password-cracking tool that enables the identification of vulnerable passwords before someone with nefarious intentions finds the weakness.

An analysis of ... passwords revealed some interesting facts about the types of passwords people use when creating accounts at web sites. The most popular ones were "123456" and "password"... Lets look at the types of password problems I've seen and what you can do make yours safer without a lot of hassle.

Late yesterday Mozilla did a whiplash-causing quick turnaround and pushed out Firefox 3.0.3. It seems this new version is solely to fix bug 454708 - storage-Legacy can throw when calling ConvertToUnicode, which is geek-speak for being unable to retrieve saved passwords or save new passwords, according to the release notes.