# Hide my MFA codes

> Hides MFA codes from prying eyes.

Canonical page: [https://chrome-stats.com/d/hide-my-mfa-codes](https://chrome-stats.com/d/hide-my-mfa-codes)

## Overview

- **ID:** `hide-my-mfa-codes`
- **Platform:** Firefox
- **Type:** Firefox add-on
- **Status:** Removed
- **Publisher:** Jeroen Swen
- **Category:** privacy-security
- **Daily users:** 1
- **Version:** 1.0.2
- **Last updated:** 2022-10-10
- **First published:** 2022-10-09
- **Size:** 12 KB
- **Data as of:** 2022-11-23
- **Store listing:** [Firefox Add-ons Store](https://addons.mozilla.org/firefox/addon/hide-my-mfa-codes/)

## Description

<i><b>What is Hide my MFA codes?</b></i>
<i>Hide my MFA codes</i> turns <i>Multi-Factor Authentication</i>-related input fields into Password fields. This prevents any prying eyes from stealing MFA codes, effectively reducing potential attack-windows from 30 seconds to <b>0</b>.

In other words, codes will no longer be shown as "123456", but as "******" instead.

<i><b>Is showing MFA codes really a security issue? Aren't you just being paranoid?</b></i>
An attack like this is indeed highly theoretical. Someone would need access to your regular credentials <i>and</i> look over your shoulder either physically or through a camera <i>and</i> use the token within the time it expires.

So is an attack likely? No.
Is the impact of a successful attack high though? Yes.

Verification codes are shown to give users a balance between security and usability. I personally choose security.

<i><b>What's with the "Access your data for all websites" install notification?</b></i>
The way this add-on, like most other add-ons, works is that it injects a JavaScript function in every page so that it can detect MFA-related fields and change them to Password-fields. To do this, it will require access to every page you visit. If you are skeptic about installing this add-on (which I can only applaud), please check out the source-code to be reassured.
<i>Tip: To view the actual source code of add-ons, right-click the "Add to Firefox"-button and press "Save link as...". A file with the extension '.xpi' will be downloaded. This is actually a ZIP-file, so just rename it to .zip and you can view the source-code of the add-on.</i>

<i><b>A verification code field was not hidden / A field was hidden that was not a verification code field</b></i>
Unfortunately developers across the world have to deal with the most difficult question in development: "How to name things?". This is no different for MFA input fields. While creating this webextension I encountered different names for almost every web-application. I've created a regular expression to deal with this, but it's not perfect. There could be undetected fields.

If you encounter any problems, please let me know by creating a new issue here: <a href="https://prod.outgoing.prod.webservices.mozgcp.net/v1/a8f0efc3bc51292bb46e07b3a0376e85619c8771e570399dcce620dc7da93006/https%3A//gitlab.com/jeroen.swen/hide-my-mfa-codes/-/issues" rel="nofollow">https://gitlab.com/jeroen.swen/hide-my-mfa-codes/-/issues</a>. Make sure to include a link to the service and preferably the ID and Name of the input element.

## Permissions and access

### Content script matches

- `*`

## Safety

- **Risk impact:** Moderate risk impact
- **Risk likelihood:** High risk likelihood

### Analysis details

- Allows access to all websites, posing a significant security risk as it can monitor and modify data from any visited site.
- This extension is not longer available in the store

> Some risk analysis details are omitted from this free response. [Upgrade to view the full analysis](https://chrome-stats.com/pricing).

## Similar extensions and apps

- [MFA Manager](https://chrome-stats.com/d/mfa-manager) — 15 users
- [Browser MFA Authenticator](https://chrome-stats.com/d/browser-mfa-authenticator) — 29 users
- [Maskerade - Blur your login details](https://chrome-stats.com/d/maskerade) — 2 users
- [MFAuth - 2FA Authenticator](https://chrome-stats.com/d/mfauth) — 18 users
- [Hide Sensitive Information](https://chrome-stats.com/d/hide-sensitive-information) — 1 users
- [Authenticator](https://chrome-stats.com/d/auth-helper) — 145,840 users, 4.26 / 5
- [Akamai MFA for Firefox](https://chrome-stats.com/d/akamai-pushzero-authenticator) — 69 users, 3.33 / 5
- [AT&T MFA for Firefox](https://chrome-stats.com/d/att-mfa) — 1 users
- [Font Fingerprint Defender](https://chrome-stats.com/d/font-fingerprint-defender) — 1,598 users, 4.15 / 5
- [Password-Toggle](https://chrome-stats.com/d/password-toggle) — 39 users, 5.00 / 5
- [Authentication - 2FA](https://chrome-stats.com/d/authentication-2fa)
- [CrecenTech Utilities](https://chrome-stats.com/d/crecentech-utilities-moz-fire) — 33 users

---

Source: [Chrome-Stats](https://chrome-stats.com/d/hide-my-mfa-codes)