Which is a safe way to record Firefox passwords in Gnome Seahorse Keyring?

Question

Searching for answers about ways to record Firefox passwords in Gnome Seahorse Keyring vault,
I found severals possibilities:

1. Firefox Gnome Keyring firefox addon
   _{from https://github.com/ in this answer and this answer}

2. Gnome keyring password integration firefox addon
   _{from https://addons.mozilla.org/en-US in this question}

3. Integration con Gnome Keyring firefox addon
   _{from https://addons.mozilla.org/fr
   seems to be the Spanish version of the previous bullet on the French server (humm weird)}

4. add this PPA in https://launchpad.net and install package called "mozilla-gnome-keyring"
   _{from this bugzilla}

But now how can I know which solution is safe ?

Solution 1

Here is my analyze to the 4 possibible ways to record Firefox passwords listed in your question,
plus a new solution (#5):

1. Their are some notes to security in the README. It seems that it is not more or less secure then the original implementation. But for GNOME Keyring you have some options like auto-lock your keyring after a certain (idle) time.

2. Source can be found on the Add-On-site under "Version Info" -> "View the Source" and yes, it is from a spanish coder as you can see by following the link to the authors website. A drawback for this extension is the missing license which makes it no FOSS.

3. is the same as 2., Mozilla just localize their websites

4. Is just a packaged version of 1.

5. A new competitor seems to be this "GNOME Keyring Integration"-Add-On. It's licensed under the GPLv3 and is very lightweight. Source can also be found on the Add-On-site under "Version Info" -> "View the Source". So you can also take a full review.

Solution 2

After posting this question on an other Stack Exchange site,focused on IT security
I got this answer:

• add-on #1 is open source, so someone with a good knowledge could check if it is safe.
• add-on #2 and #3 are secret codes, so riskier
• solution #4, about PPA, is safe only if you trust the author

To sum-up,
with my level of knowledge and competence, there is no safe solution.
So I'll just wait till Ubuntu and Firefox produce an integrated solution without add-on needed...**

Comments

[schmunk]

Is there a way to do this with FF 58? Seems that all extensions don't work anymore on this version.

[MadMike]

A solution "being safe" doesn't really revolve around how much you know. It is always a question about whom you trust. I.e. even if you would be able to program your own keysafe you would still have to trust the compiler (and those who package and programmed it) and the CPU builder.