passwords not showing up ??? Topic is solved

[New Tobin Paradigm]

Wouldn't Master Password prevent passwords from being selected? Also, is your Windows Account not password protected? Is a thief going to actually go in, extract your Pale Moon profile when they almost certainly doesn't know what a Pale Moon is and use it JUST to get your passwords? If not, is a thief going to crack into your Windows Account and then launch the Pale Moon and then get your passwords?

OR is the more likely thing going to be.. They either remove or wipe your hard drive and take it to a pawn shop to get the quick cash they need to get the drugs that you seem to be on... Don't want saved passwords ever? Don't save passwords.. For the rest of us who do save passwords.. We are happy enough.

Also, I was right, relevant discourse has indeed ended.

[Moonraker]

I dont use windows i use linux and there are 3 password barriers to break before the desktop even appears...3 tries at the first password then the HHD self encrypts.
I think we are just dancing round the maypole here to be honest.I have aired my opinions on this and so have you and i dont fancy carrying on with a merry waltz round the mulberry bush.

general discourse of course has not run out.More opinions needed etc.

[adesh]

Moonraker, I think usable security is the right term here. If you make a system super-secure, it is going to be super-inconvenient to use also. Any software has to make certain trade-off between security and usability (convenience).

In my opinion, even if you make a simple visit to a website (form fields present or not), you are cmpromising your security and taking a risk, although this is a "conscious" risk. If you want to get perfect security from remote actors, cutting the wire is the only solution.

And don't you agree that this feature adds slightly more security to the browser? Isn't it better that before? If you ask me: a step to better browser!

[Moonraker]

I think tobin completely missed my point entirely,which he seems to do an awful lot and exploding into rages is not getting us any further.
I myself being in a free and democratic society have a right to air my opinions.

Whether the autofill function is there or not is irrelevant because once a foe or whoever has gained access to the computer then double clicking an input field which im sure anybody can do is easy peasy lemon squeezy.

what i was trying to say is that whether the passwords are visible or not is not relevant.

[postbuz]

I think tobin completely missed my point entirely,which he seems to do an awful lot and exploding into rages is not getting us any further.
I myself being in a free and democratic society have a right to air my opinions.

Not in the new paradigm

[New Tobin Paradigm]

Ok. Restate your issue more clearly and simply. Go.

[struppi]

Thanx, for the Thread.

I also don't read the release notes
Because many of the changes are not important for me and if am serious the most I don't understand (even I am working since many years in web-projects and have a little knowledge of programming).

For me this particular changing came suprising and I first saw it as a bug. But now I know your point.

Just for the discussion: I use the feature of auto-filling the forms very reasonable. I use uMatrix to prevent any active elements (even CSS) from any site by default and only activate it from sites I trust. So I am not fearing od XSS attacks.

I understand the changing anyway, but I wouldn't so suprise that some people get a bit upset, because you change their user setup.

Anyway - a very good decision to give us the opportunity to change this easily. That's the difference between many of the bad changes we knew in Firefox and why we use Palemoon.

(Oh: And I promise to read the release notes in the future )

[faithbuilders]

Thanks for all the responses. I did get it to stay on, thanks. I did understand (i think) why they did it... its not a security againsed theft. But if you are in a public place and you need to go into a site with a password, then YOU can choose when the user name pops up, you can wait until no body is around your computer, then click on user name. The old way was you go into your sight and everyone around saw your user name before you could hide it. So for that reason this is more secure.

[WestOne]

Hello,

I have unchecked the 'Automatically fill in log-in details' option for enhanced security/privacy.

My AVM FritzBox modem/router doesn't require a username:

Do I now need to look up the password manually in the password manager, or is there another way to insert the password?

Thanks for your help.

[tewitt1949]

Is there a way to go back to before the update? Or make the passwords appear again?

You decide.

AutoFillLoginDetails.png

CraigPD.........I have 8.1......Where is that preference page you show?

[CraigPD]

Independent of OS, in Pale Moon menu bar: Tools > Preferences > Security (tab) > Passwords

[Moonchild]

my laptop gets stolen and they get to my desktop...well guess what all they need to do is open browser and double click sensitive fields and voila credentials are displayed and they are in.

This has nothing to do with people physically getting access to your machine (that is what you have a master password for, as pointed out). It has everything to do with injected scripts on websites being able to get to your credentials without user interaction (meaning YOU interacting with the page) or not.

Real scenario: XSS injects a script and commonly-named (but hidden) login fields on a website you have credentials stored for. If credentials are automatically filled, the browser dutifully fills in the login details the moment the page loads, into the hidden fields, which the injected script then sends off to the hacker's server. Boom, in less than a second and without doing anything, they have your user name and password presented to their server on a silver platter!
With the new default situation, the hidden fields are never filled in (because you don't interact with them) and there's nothing to send, even if the XSS was successful on the page.

[illiad]

no mr paradox,you do NOT get it.
heres a scenario for you,
my laptop gets stolen and they get to my desktop...well guess what all they need to do is open browser and double click sensitive fields and voila credentials are displayed and they are in.

comprende.?

nothing thick about it and if you cant see the error here then you are intentionally being evasive and plain pedantic.
i will not resort to insults as it will get nowhere.

i am talking about local access to uninvited people..do YOU not get it and this is why google will not implement it in chrome..
if you will not understand THIS then i for one cannot make the blind see..

cheers.

Sorry you are missing the point... ANY browser can be ' broken into' unless you want to encrypt it all, use three levels of passwords to get in...

BUT then be lazy and set all that to automatic!!!!! you just gave the thief your keys.... NOTE also you will have to clear cookies, as these will also have stored some login details..

If you are concerned about theft, you should have a BIOS password set, an OS password set, and a screen saver set to not allow people to change that... ( Win7 pro will do this using GPEDIT.MSC, or registry settings...