Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm relying on Firefox to remember my passwords, using a Master Password of more than 25 characters. How secure is this set-up?

share|improve this question
add comment

4 Answers

up vote 16 down vote accepted

In short - Firefox uses triple DES in CBC mode with Master Password.

More details: nice article about this topic is here: http://luxsci.com/blog/master-password-encryption-in-firefox-and-thunderbird.html and if you want some more details, here is mozillaZine article: http://kb.mozillazine.org/Master_password.

It is believed that it is safe to store passwords such way, however, I do not trust any software. Maybe it sounds too paranoid, but we can never know where the vulnerability hides.

share|improve this answer
3  
One article says to enable FIPS for improved protection. Why isn't FIPS enable by default then? –  Roger Wernersson Nov 18 '10 at 8:36
add comment

In order to answer "How secure are my passwords in the hands of Firefox using a Master Password?" If Firefox has any exploitable bug, then it is not secure no matter how much encryption is wrapped around your passwords. Had the question started with "Assuming Firefox is the most secure browser available in terms of exploits and ignoring any plugins..." then i would agree the answer may be irrelevant. If a click interface that is not susceptible to keystroke logging is used, then the passwords may still be safe even with a keystroke-logger in the browser. If there is a "man-in-the-browser", physically typing in a password can be intercepted and if Mozilla emulates key-presses then these would also be intercepted. If Firefox uses more direct memory access, i still would not be surprised if it could be intercepted.

If there is a "man-in-the-machine" or rootkit, then all your passwords are owned.

share|improve this answer
2  
Sounds correct, but irrelevant. This is true even if I don't let Firefox save my passwords. The root-kit problem is true for all applications on the infected computer, not specific to Firefox. –  Roger Wernersson Jun 28 '11 at 10:30
add comment

Firefox sync stores your passwords and transfers them to other synced computers, but doesn't secure them with your master password.

So if an attacker can open your browser and activate sync, then sync with a profile on their browser, your passwords will be synchronised!

share|improve this answer
3  
I finally found the time to test this and it seems activating sync requires my master password, if I have one set. This should make your point a non-issue. –  Roger Wernersson Sep 28 '12 at 17:08
add comment

I believe that the password recovery tool from nirsoft.net can just bypass this, but I have not checked this specifcally

share|improve this answer
2  
I though such tools used a brute-force approach, if protected by a Master Password. –  Roger Wernersson Nov 22 '10 at 8:42
1  
Nah, usually this crap can just be reverse engineered and the flow of execution modified to skip little requirements like passwords to access local datastores. –  atdre Nov 22 '10 at 21:27
3  
Hmm. Define "this crap" please. :-) Also, I believe the password file on Firefox is encrypted –  Roger Wernersson Jun 28 '11 at 10:31
    
@RogerWernersson It is, there is an option for FIPS-140 support too (developer.mozilla.org/en/docs/NSS/FIPS_Mode_-_an_explanation). atdre please gives sources rather than telling lies. –  Shadok Oct 10 '13 at 15:01
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.