I'm currently testing a free personal SSL certificate (S/MIME client / authentication) from https://www.startssl.com, which installed directly into Firefox. Now when I store backup, I have to enter a password. But how is the certificate stored in Firefox itself secured? Shouldn't I have to enter a password at some point?
The "master password" that Firefox allows you to set, when remembering passwords for sites, is also used to protect the private keys for personal certificates (that is, they are encrypted with a key derived from that master password). Firefox may fail to suggest setting such a password when generating a new key if you instructed it not to use one.
Note that some other browsers let the operating system handles such things (e.g. under MacOS X, Chrome uses the OS-provided "Keychain" system for private key storage). Firefox, out of tradition, is self-contained in that respect.
The SSL certificate to authenticate to startSSL is like a key, FF does provide a way for someone with access to the machine to export the keys, unless you set the password manager's password. (see Thomas Pornin)
If that password is not set you will be dependable on your OS security.
|show 6 more comments|