TheBearAK wrote:
Not really a flaw, but if you don't set your master password in Firefox, anyone using your Firefox can easily look at your passwords that you've saved. By default, there is no master password.
I personally don't use a master password in Firefox, which acts as your key to encrypt the password database. Instead, I do what Mozilla recommends as the best protection for passwords. That is hardening the database itself by strongly encrypting(AES/256) the entire Firefox profile folder. In my case, in a Truecrypt virtual container.
But this is only effective if you dismount the encrypted container when leaving your computer unattended. In which case, I made a shortcut icon that logs off my user account, while also dismounting all Truecrypt containers(3) with one-click.
