The Master Security Device Password Dialog is a simple dialog box with a single text entry field and a couple of buttons. It would be about the easiest piece of GUI programming to pop one up on top of a Firefox window from a bit of malware. How can I know that the Master Security Device password entry box is secure? I wonder this every time I see the box pop up when I'm not trying to log into a website. It happens every day. You should consider adding some element to improve the trustability of this feature. For example many sites let you upload a security image. The image could be stored securely by Firefox and displayed as part of the password dialog box. This would give me confidence that it was indeed Firefox asking for my most important password.