documentation_complete: true

title: 'Disable the Firefox Password Store'

description: |-
    Firefox allows users to store passwords whether or not a master password
    is set for the password store. To disable the storing of passwords, set
    <tt>signon.rememberSignons</tt> to <tt>false</tt>.

rationale: |-
    Autofill of a password can be enabled when a site is visited. This feature could also
    be used to autofill the certificate pin which could lead to compromise of DoD information.

severity: medium

identifiers:
    cce: ""

references:
    disa: ""
    nist: ECSC-1
    stigid: DTBF160

ocil_clause: 'it is not disabled'

ocil: |-
    To verify that the password store is disabled,
    run the following command:
    <pre>$ grep 'signon.rememberSignons' <i>FIREFOX_INSTALL_DIR</i>/*.cfg</pre>
    The output should return:
    <pre>lockPref("signon.rememberSignons", "false");</pre>
