A security flaw in the way Firefox 2 and Internet Explorer 7 handle passwords means they could be vulnerable to phishing attacks.

According to the Chapin Information Services (CIS) web site, the attacks are targeting Internet Explorer and Firefox but a flaw in the latter makes it more vulnerable.

The problem concerns the Passwords Manager component which automatically fills in password details in forms on web sites without checking where the data is being sent.

To take advantage of the flaw, an attacker has to create a fake login page on a trusted site. Such an attack is possible and recently affected MySpace when its login page was hacked.

Mozilla and Microsoft are both working at fixing the problem in their browsers, but for now the advice of security company Secunia is that Firefox users go to Tools > Options > Privacy and make sure the box by 'Remember what I enter in forms and the search bar' is unchecked.

CIS

Secunia

Related Tips: Start Using Internet Explorer 7

Browse The Web With Firefox