How does Firefox protect Logins and Credit Card Data?

Question

I have a question about how Firefox protects Login information (Website passwords) on the one hand and Credit Card data on the other. I noticed that there are two different approaches to how Login passwords are protected and to how Credit Cards are protected.

Logins can be protected with a primary password (formerly called master password). When set, Firefox requires me to authenticate with that password upon opening Firefox and then it also forces me to enter it whenever I want to view, copy, or edit the passwords in about:logins (although it does not ask me to authenticate when I want to fill a password on a website asking for it).

Credit Card information, on the other hand, is not protected by a password, but I can ask Firefox to require OS authentication (for example, TouchID on Mac, or the computer password of the user) to view, edit, and fill that information. Unlike with the login data, when I have that option checked, then it also asks me to authenticate when I want to fill credit card information on a website asking for it.

See the two options as they show in the preferences:

In an answer to a question about this on the Firefox support forum, user cor-el warned that using OS authentication for passwords instead of a Primary Password is actually not really safe because it doesn't encrypt logins in logins.json and it would be possible to extract them by running: prompt("Logins",JSON.stringify(Services.logins.getAllLogins()));

Now I am a bit confused because for storing Credit Cards the default is, of course, using OS authentication (there is no option to set a password instead). So I am wondering, is that safe? I.e., is the credit card information still encrypted, even though I can retrieve it with my TouchID (without a Primary Password)?

And if so, would anybody be able to explain the differences between these two approaches and why the Firefox developers might have chosen one for Logins/Passwords but the other for Credit Cards?

From a UX perspective, it doesn't make a whole lot of sense to have two different approaches for sensitive information (other password managers treat Credit Cards and Passwords in the same way).

Furthermore on Firefox Lockwise for iOS, it is possible to unlock with TouchID or FaceID. So why here and not on a Desktop computer in the Firefox browser? Is the OS authentication more secure on mobile? If anybody could enlighten me about this I'd much appreciate it. (I asked about this issue over at the Firefox support forum but never got any response.)

Answer 1

The documentation states:

As a precaution, your CVV number is not saved. You can also choose to password protect your credit card data for an additional layer of protection.

To add further protection, you can select to require authentication before autofilling the credit card information. This requires your operating system password (or authenticate using your fingerprint, face or voice login if enabled) this is usually the password used to unlock your computer. Please note, this is not your Firefox Account password.

This leads me to believe that by default ... they dont protect your CC info. I mean, its prob not accessible to the javascript sandbox with out your interaction, however, it seems like they are stored 'cleartext'? unless you opt in to have them protected via password. While they dont explicitly say that they encrypt the CC info with the password. I think it would be safe to make that assumption (if anyone knows diff please correct me).

The code dealing with this can be found here: https://hg.mozilla.org/mozilla-central/file/tip/toolkit/components/formautofill/default/FormAutofillStorage.jsm

The following snipit leads me to believe that if a password is not used it is indeed stored in clear text: