{"id":91,"date":"2005-09-25T20:07:02","date_gmt":"2005-09-25T10:07:02","guid":{"rendered":"http:\/\/www.somethinkodd.com\/oddthinking\/?p=91"},"modified":"2007-09-10T18:30:05","modified_gmt":"2007-09-10T08:30:05","slug":"browser-comparison-password-management","status":"publish","type":"post","link":"https:\/\/www.somethinkodd.com\/oddthinking\/2005\/09\/25\/browser-comparison-password-management\/","title":{"rendered":"Browser Comparison: Password Management"},"content":{"rendered":"<p><!-- UnMarkedDown_2_01132526433--><\/p>\n<h2>Abstract<\/h2>\n<p>In the comments to <a href=\"http:\/\/www.somethinkodd.com\/oddthinking\/2005\/09\/22\/lets-fail-to-log-in-again-like-we-did-last-summer\/\">my last post<\/a> about web-page password management  <a href=\"http:\/\/www.caseyporn.com\">Casey<\/a> and <a href=\"http:\/\/www.girtby.net\">Alastair<\/a> explained that their favourite browsers (Opera and Safari respectively) has cool web-page password management features.<\/p>\n<p>I planned to send a comment back to them stating that all of the big browsers had identical functionality in this area, and there was nothing between them.<\/p>\n<p>I tested the hypothesis first, and the results were more interesting than I thought. A quick comment turned into this article instead.<\/p>\n<h2>Hypothesis<\/h2>\n<p>That all of the big browsers have identical functionality for Password Management.<\/p>\n<h2>Method<\/h2>\n<p>I found a publicly-available free-to-register site that suffers from the <a href=\"http:\/\/www.somethinkodd.com\/oddthinking\/2005\/09\/22\/lets-fail-to-log-in-again-like-we-did-last-summer\/\">&#8220;automatic-login-only-works-the-second-time dance&#8221;<\/a> &#8211; and now you can see why I was keen to find a better name. Once we name a problem, it is easier to discuss its solutions. The site is the <a href=\"http:\/\/wordpress.org\/support\">WordPress Support<\/a> site.<\/p>\n<p>I attempted to reproduce the problem in Opera, IE and Firefox. I am afraid I have no access to Safari, so I based it entirely on <a href=\"http:\/\/www.somethinkodd.com\/oddthinking\/2005\/09\/22\/lets-fail-to-log-in-again-like-we-did-last-summer\/#comment-757\">Alastair&#8217;s comment<\/a>. I apologise for not going to original sources.<\/p>\n<h2>Results<\/h2>\n<table border=1 cellspacing=0 cellpadding=2>\n<tr>\n<td><strong>Browser?<\/strong><\/td>\n<td><strong>Has Password Management?<\/strong><\/td>\n<td><strong>Supports Multiple Passwords for Each Username?<\/strong><\/td>\n<td><strong>Password Stored Per:<\/strong><\/td>\n<td><strong>Credential Editability?<\/strong><\/td>\n<td><strong>UI<\/strong><\/td>\n<\/tr>\n<tr>\n<td>Firefox 1.0.4<\/td>\n<td>Yes<\/td>\n<td>No &#8211; re-using a username will automatically override existing stored password.<\/td>\n<td>Domain<\/td>\n<td>Deletion + Display of passwords in clear-text available. <\/td>\n<td>Click (pre-selected) username field to choose username. Tools | Options | Saved Passwords | View Saved Passwords to display or delete. <\/td>\n<\/tr>\n<tr>\n<td>Internet Explorer 6.0<\/td>\n<td>Yes<\/td>\n<td>No &#8211; re-using a username will prompt to override existing stored password.<\/td>\n<td>URL <\/td>\n<td>Deletion only.<\/td>\n<td>Click (pre-selected) username field to choose username. Delete key to delete one. Tools | Internet Options&#8230; | Content | AutoComplete | Clear Passwords  to delete all. <\/td>\n<\/tr>\n<tr>\n<td>Opera 8.02<\/td>\n<td>Yes<\/td>\n<td>Yes<\/td>\n<td>URL or Domain &#8211; user-selectable<\/td>\n<td>Deletion only? [No option to edit. I couldn&#8217;t get add (New) to work.]<\/td>\n<td>CTRL+ENTER to choose username. Delete button to delete one. Tools | Advanced | Wand Passwords&#8230; to delete by site. No ability to delete all? <\/td>\n<\/tr>\n<tr>\n<td>Safari<\/td>\n<td>Yes<\/td>\n<td>No<\/td>\n<td>Domain<\/td>\n<td>???<\/td>\n<td>???<\/td>\n<\/tr>\n<\/table>\n<h2>Discussion<\/h2>\n<p>So there are some visible differences between the systems.<\/p>\n<p>Notably Firefox and Internet Explorer take different approaches to the scope of the password. Firefox appears to offer the same username\/password combination to any site on the same domain. Internet Explorer insists that it be the same URL. Opera offers the choice to the user.  If you store it per domain, the dance is resolved! All of the login points for the domain will be equivalent. However, you need to trust the domain not to allow <a href=\"http:\/\/en.wikipedia.org\/wiki\/XSS\" title=\"Wikipedia definition of XSS\" class=\"wikipedia\">XSS hacks<\/a>.<\/p>\n<p>There was a difference in usability too. In my opinion, Opera was the worst &#8211; requiring an unguessable CTRL+ENTER combination &#8211; I couldn&#8217;t find a menu item equivalent. Internet Explorer and Firefox were not much better. Clicking on the username field <em>twice<\/em> is more guessable, but still no other means to get there!<\/p>\n<p>Opera&#8217;s ability to store multiple passwords for a single username seemed a misfeature to me. I can&#8217;t imagine why anyone would want to have this feature, and it made selecting the correct credentials difficult &#8211; you had to select the correct item from two choices that are indistinguishable. Internet Explorer&#8217;s prompt to warn you that you were choosing to override the password makes the most sense to me, and it has saved me a few times.<\/p>\n<p>Firefox&#8217;s ability to display passwords in cleartext appears to be a terrible security hole. Don&#8217;t let me play on your computer for even two minutes if you use Firefox &#8211; I&#8217;ll have your passwords for all your favourite sites and, if you are like much of the world, you use the same password for your PayPal and eTrade accounts too.<\/p>\n<p>I have largely ignored Safari &#8211; I don&#8217;t have enough information to really judge it. <\/p>\n<h2>Conclusion<\/h2>\n<p>My hypothesis was wrong. When I looked at the browsers with more care, I noticed key differences in their functionality.<\/p>\n<p>None of the browsers I looked at passed with flying colours.<\/p>\n<p>Internet Explorer is the most likely to suffer from the original problem. It has reasonable usability and security. It does require you to learn a couple of tricks, but they are useful throughout Windows (e.g. Windows explorer and Internet Eplorer&#8217;s address bars and also file-completion in the file-choosers)<\/p>\n<p>Opera&#8217;s power is the greatest and its usability is the worst. If you stick to the default scope, it also lets you suffer the worst &#8211; typing in a correct password on the opening page doesn&#8217;t solve the problem.<\/p>\n<p>Firefox is probably gets the most points for usability, and discards them again with its security.<\/p>\n<p>Each of these browsers is evolving. Maybe they will all improve over time.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The password management facilities of three common browsers are compared and contrasted<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_s2mail":"","footnotes":""},"categories":[31,25,47],"tags":[],"class_list":["post-91","post","type-post","status-publish","format-standard","hentry","category-geek","category-insufficiently-advanced-technology","category-review"],"_links":{"self":[{"href":"https:\/\/www.somethinkodd.com\/oddthinking\/wp-json\/wp\/v2\/posts\/91","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.somethinkodd.com\/oddthinking\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.somethinkodd.com\/oddthinking\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.somethinkodd.com\/oddthinking\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.somethinkodd.com\/oddthinking\/wp-json\/wp\/v2\/comments?post=91"}],"version-history":[{"count":0,"href":"https:\/\/www.somethinkodd.com\/oddthinking\/wp-json\/wp\/v2\/posts\/91\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.somethinkodd.com\/oddthinking\/wp-json\/wp\/v2\/media?parent=91"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.somethinkodd.com\/oddthinking\/wp-json\/wp\/v2\/categories?post=91"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.somethinkodd.com\/oddthinking\/wp-json\/wp\/v2\/tags?post=91"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}