13

If you ask Mozilla Firefox to remember the login details for a website, the credentials will be stored in your profile directory in Logins.json.

Instead of storing plaintext values, the username and password will be encrypted (using the PKCS #11 API implemented in Mozilla's NSS library). However, the key required to decrypt them is also stored in your profile directory (in Key3.db). Therefore, an attacker who acquires that directory will obviously also be able to extract the stored passwords (that is, unless the owner has set a master password).

This got me curious: What was the motivation to encrypt the passwords in Logins.json by default when the key is stored nearby? In which realistic scenario could this design decision complicate an attack?

Improve this question
3
  • 6
    If you set a master password, the information in Key3.db does not allow you to decrypt the passwords if you do not know the master password.
    – Anders
    Commented May 29, 2016 at 22:49
  • 1
    Maybe Logins.json is also used for synchronizing the passwords when logged into Firefox sync, in which case Key3.db would not leave the local machine. Does anyone know more?
    – Potaito
    Commented May 30, 2016 at 11:40
  • 1
    Why aren't you using a master password so the security is complete? So the question should more likely be, "Why doesn't Firefox by default, explain the need for, and ask for a Master Password?"
    – Fiasco Labs
    Commented May 31, 2016 at 3:09

2 Answers 2

Reset to default
10

It's probably to simplify the implementation. Rather than having two cases where the key store could be encrypted or not depending on whether Master Password is set, the code always encrypts.

This reduces the likelihood that a code path that forgets to encrypt when Master Password is enabled goes unnoticed.

Improve this answer
1
  • 2
    I ignored that the default case simply simulates an empty master password. You are right in that this is likely a convenient implementation rather than a specific security measure.
    – Arminius
    Commented May 31, 2016 at 16:20
3

I'd say that the reason is to obfuscate the stored passwords, and that the "remember websites passwords" feature in Firefox is supposed to be always used with a master key.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .