Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

As a follow-up to another question, is the encryption via Firefox' master password more secure than simply NTFS encrypting the profile folder? I.e. is there a convincing reason to add the inconvenience of another password whereas NTFS encryption is coupled to my Windows login?

share|improve this question
    
Related: How secure is NTFS encryption? –  Tobias Kienzler Oct 16 '12 at 13:30
    
add comment

3 Answers

up vote 2 down vote accepted

I recommend you to use a Password manager like Keepass : http://keepass.info/

KeePass is a free open source password manager, which helps you to manage your passwords in a secure way. You can put all your passwords in one database, which is locked with one master key or a key file. So you only have to remember one single master password or select the key file to unlock the whole database. The databases are encrypted using the best and most secure encryption algorithms currently known (AES and Twofish).

share|improve this answer
1  
That's how I actually secure my passwords, but Firefox/Thunderbird also store SSL certificates, which Keepass can't take care of. –  Tobias Kienzler Oct 17 '12 at 14:59
    
Since I dropped using that SSL certificate, I'm purely using Keepass + Keefox, so you get the checkmark now –  Tobias Kienzler Feb 5 '13 at 6:31
add comment

I'd say it's equally secure. If you forget to lock your computer when you go away someone could access that folder because it will not be encrypted anymore. However if you forget to lock your computer you might leave your browser opened as well after you introduced the master password.

If your system gets compromized (for instance remote access by exploitation) then neither will save you as an attacker could install a keylogger and get it that way.

share|improve this answer
add comment

You're protecting two different things. NTFS only provides storage protection. The Firefox master password provides protection in terms of storage, and up to the point of use.

Once in use, your filesystem will be decrypted for any application you're running. In contrast, the FF-based encryption will give access to your private key only to FF when it's running. Provided that the memory used by distinct applications is properly isolated by the OS, other applications won't have access to it.

If your machine is compromised with a keylogger or something similar, neither approaches help much, but the FF master password should at least protect your from "semi-trustable" applications: those that don't take control of your system, but can at least read what they like on your filesystem, while you're logged on. Of course, this depends on which applications your run.

In addition, assuming that you leave your seat without locking your machine, while another user could make use of that certificate and private key here and there if you've also left FF running, they wouldn't be able to export a copy of it without having to enter your master password when exporting (even if you've already typed in your master password for FF to use, it's a different thing), whereas they could easily copy/export these files when there's no master password.

share|improve this answer
    
That's a good point, I didn't think about having to trust all other applications... So I really should cope with the additional password :-/ –  Tobias Kienzler Oct 16 '12 at 16:45
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.