search

simple-login / browser-extension

SimpleLogin Chrome/ Firefox extension
MIT License
173 stars 34 forks source link

After logging into Firefox account on brand new device, SimpleLogin extension automatically logs in too #121

Open Asheq opened 2 years ago

Asheq commented 2 years ago

I noticed that if I login to my Firefox account on a brand new device (or brand new Firefox profile), the SimpleLogin extension automatically logs in to SimpleLogin too.

I understand this is convenient, but I wonder if it is a security risk?

If someone manages to compromise my Firefox account, then they also automatically get access to SimpleLogin via the extension.

FWIW, other extensions don't do this (e.g., Bitwarden); they are logged out and explicitly require logging in before granting access.

FozzieHi commented 2 years ago

I agree, I think that API keys should be saved in local storage. I think this is currently happening because all settings are saved in sync storage. It should be fairly simple to move just the API values to local storage, but this may require users to re-input their API keys. What do you think about this @nguyenkims?

nguyenkims commented 2 years ago

@FozzieHi that's indeed the cause :)