Should I use a Firefox master password or NTFS encrypt my profile?

Question

As a follow-up to another question, is the encryption via Firefox' master password more secure than simply NTFS encrypting the profile folder? I.e. is there a convincing reason to add the inconvenience of another password whereas NTFS encryption is coupled to my Windows login?

Answer 1

I recommend you to use a Password manager like Keepass : http://keepass.info/

KeePass is a free open source password manager, which helps you to manage your passwords in a secure way. You can put all your passwords in one database, which is locked with one master key or a key file. So you only have to remember one single master password or select the key file to unlock the whole database. The databases are encrypted using the best and most secure encryption algorithms currently known (AES and Twofish).

Answer 2

You're protecting two different things. NTFS only provides storage protection. The Firefox master password provides protection in terms of storage, and up to the point of use.

Once in use, your filesystem will be decrypted for any application you're running. In contrast, the FF-based encryption will give access to your private key only to FF when it's running. Provided that the memory used by distinct applications is properly isolated by the OS, other applications won't have access to it.

If your machine is compromised with a keylogger or something similar, neither approaches help much, but the FF master password should at least protect your from "semi-trustable" applications: those that don't take control of your system, but can at least read what they like on your filesystem, while you're logged on. Of course, this depends on which applications your run.

In addition, assuming that you leave your seat without locking your machine, while another user could make use of that certificate and private key here and there if you've also left FF running, they wouldn't be able to export a copy of it without having to enter your master password when exporting (even if you've already typed in your master password for FF to use, it's a different thing), whereas they could easily copy/export these files when there's no master password.

Answer 3

I'd say it's equally secure. If you forget to lock your computer when you go away someone could access that folder because it will not be encrypted anymore. However if you forget to lock your computer you might leave your browser opened as well after you introduced the master password.

If your system gets compromized (for instance remote access by exploitation) then neither will save you as an attacker could install a keylogger and get it that way.