The Firefox browser stores not only a user's bookmarks, history, saved forms, and usernames and passwords, but frequently also several extensions and themes. When you're switching computers or distro-hopping, replicating the browser environment can be tricky and time-consuming.

According to a message posted over the weekend on the Full-Disclosure mailing list, the latest version of Firefox, 2.0.0.5, contains a password management vulnerability that can allow malicious Web sites to steal user passwords. If you have JavaScript enabled and allow Firefox to remember your passwords, you are at risk from this flaw.

Better delete your passwords from Firefox's Password Manager before next week's Black Hat security conference in Las Vegas. That's when Jeremiah Grossman will present a demo showcasing how Javascript can be used to collect passwords from Firefox.

Well that is OK then. No sooner has Mozilla updated Firefox to 3.0.2 and broken my saved passwords so they cannot be accessed, nor can I create new ones, than it announces it is 'working real hard' to get Firefox 3.0.3 out to fix the mess.

"You know that sick feeling you get in the pit of your stomach, the one that means either you forgot your mother’s birthday or even worse - your password for your favorite web site. Thankfully if Firefox has been remembering these passwords for you, recovering them in an easy task..."

Late yesterday Mozilla did a whiplash-causing quick turnaround and pushed out Firefox 3.0.3. It seems this new version is solely to fix bug 454708 - storage-Legacy can throw when calling ConvertToUnicode, which is geek-speak for being unable to retrieve saved passwords or save new passwords, according to the release notes.

Mandriva, the Linux vendor, has announced "Click'n'Backup", its own web based backup system. The service, reminiscent of the recently launched Canonical's Ubuntu One, includes online secure storage space and a backup and restore tool. Unlike Ubuntu One, the backup and restore tools are available for non-Mandriva Linux systems, Windows and Mac OS X.

"As announced, and earlier than expected, a quick Firefox update has been released to fix a single bug that prevented some users accessing their saved passwords..."

Enforcing password security with a multiple-user system can be a hassle — users all too often use inadequate passwords. john-the-ripper (also available via most distros) is a password-cracking tool that enables the identification of vulnerable passwords before someone with nefarious intentions finds the weakness.