iCloud iCloud Passwords for FireFox

[Johnny Jackhammer]

FireFox ADD-ONS lists an extension iCloud Passwords for install. I installed it and then realized it's not developed by Apple. It is on GitHub and open source. Should I be concerned and did I just give someone access to my Apple Keychain and Passwords?

Seems like Apple would take issue with a third party developer using the exact same name for an extension that they've created for Chrome and Microsoft Edge... no?

This add-on is not actively monitored for security by Mozilla. Make sure you trust it before installing.

This extension lets you securely fill passwords from iCloud Keychain® when signing in to websites using Firefox. It also provides you with strong passwords to secure your online accounts.
Compatible with macOS® Sonoma only.

This extension is not endorsed in any way by Apple Inc.
iCloud, iCloud Keychain, and macOS are trademarks of Apple Inc., registered in the U.S. and other countries and regions.

 

[coffeemilktea]

If it's on GitHub and open-source, it's probably not malicious... but it does sound like quite the potential security disaster regardless. I'd uninstall it and change some passwords, if I were you.

 

[Johnny Jackhammer]

If it's on GitHub and open-source, it's probably not malicious... but it does sound like quite the potential security disaster regardless. I'd uninstall it and change some passwords, if I were you.

I uninstalled it before I made this post.

It uses an authentication similar to what Apple uses. Sends a message with a 6 digit code and that comes from Apple. I entered the code to allow it access. So if it's malicious it's too late. I have a few hundred passwords in iCloud Keychain. Don't think I will be changing "some passwords" without evidence my stuff is out in the open.

 

[Johnny Jackhammer]

Any timeline on when Apple's Passwords.app will have a plug in for FireFox?

 

[DigiH]

I was wondering the same, and this issues thread from the current extension is interesting

Unmaintained? · Issue #52 · au2001/icloud-passwords-firefox

This plugin appears to be unmaintained, with the last commit made five months ago. Given the security sensitivity of this plugin, we would greatly appreciate any clarification on its current status...

github.com

Not sure if the now Apple Inc. owner is offical and trusted now, but I hope things will clear up soon enough.

 

[MrRaupi]

Finally, Apple released its official iCloud Passwords Firefox extension:

https://addons.mozilla.org/en-US/firefox/addon/icloud-passwords/