In studying SSL / TLS handshakes and encryption, I found a method that describes how to export the SSL / TLS session keys from Firefox to an user or environmental variable outside the browser, and then decrypt the TLS packets using Wireshark (method described at: https://isc.sans.edu/forums/diary/Psst+Your+Browser+Knows+All+Your+Secrets/16415 ). This method is very easy to do – I was able to decrypt communications with HTTPS sites, including login credentials.
Per the link above and my own testing, this method only works for Firefox and Chrome; not Internet Explorer or other non-browser SSL traffic (see https://msdn.microsoft.com/en-us/library/windows/desktop/aa387409%28v=vs.85%29.aspx for MSDN recommendation, but they essentially do not save the session keys in the clear by default). The method is also described on the Mozilla Development Network (MDN) site at: https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/Key_Log_Format and also Information Security Exchange, for example at: Decrypting TLS in Wireshark when using DHE_RSA ciphersuites ).
The method does require access to the system settings to configure the necessary environment variable, but that is all. Both Firefox and Chrome look for the variable automatically, and if they find it, start logging keys to the location. The browsers do not alert the user or ask for permission, nor does there seem to be a way in Firefox’s about:config to turn this logging off. I realize that full access to the system to set up the variable could presume that the system is already compromised, but the level of protection seems much less than other security information. For example, system access does not allow easy access to the SAM or TPM security modules (there are other ways to get access of course, but it is not a point and click).
This method would seem to allow a very stealthy export of the SSL / TLS session keys (they are only 128 or 256 bits each) by third parties who could capture the network traffic separately from the key export and then decrypt at their leisure. This decryption could occur in spite of the use of any "perfect forward secrecy" asymmetric keys, and could reconstruct browsing sessions long after the fact. Any other program with access to your Windows folder structure could also ex filtrate the keys, and you would never know.
Why do Firefox and Chrome allow such easy leaking of these session keys? I read some speculation that this was a debugging feature, but why is it left on by default? Note that other browsers do not leak the session keys. Should I be concerned about this?