I know that the file logins.json contains all my encrypted passwords in Firefox browser. How does Firefox encrypt these passwords if I don't use the 'Master Password' option? Does this mean key3.db file is used also if I didn't select Master Password?


When the profile is initialized, a blank password (an empty string) is used. You can find the code for this in toolkit/components/passwordmgr/crypto-SDR.js on line 64:

if (token.needsUserInit) {
  this.log("Initializing key3.db with default blank password.");

Additionally, based on the import method in toolkit/components/passwordmgr/LoginImport.jsm on line 68, the encrypted passwords are imported into logins.json from key3.db without modification. Therefore, they will be using the same default password.

  • 1
    So basically all the passwords that firefox has cached are exposed? What about chrome? – Ant Dec 27 '15 at 19:00
  • 9
    @Ant Most users do not use Firefox's "master password" feature to protect their stored passwords, so they would be at risk if their password file could be stolen. It is a trade-off between convenience and security. – Austin Hartzheim Dec 27 '15 at 19:09
  • 5
    @Ant On Windows, Chrome encrypts the passwords with Windows DPAPI, which can be decrypted by any program running as the Windows user, unless the user's logon password is forcibly reset. – Ben N Dec 27 '15 at 20:11
  • @AustinHartzheim thanks for your answer! I checked in logins.json and I saw that my passwords are not saved in clear text... so what is exactly the process done on the passwords? If I take for example the password 'pass123' how it will be saved in logins.json? – Hila Dec 28 '15 at 7:41
  • 1
    @Hila: I guess Firefox doesn't optimize for the empty-password case by having extra code to skip the encrypting. As the code shows, they turn the empty string into a crypto key (somehow, doesn't matter how). There's no choice of key that will produce ciphertext = plaintext. All that matters is that the empty string produces the same key every time, just like any other string produces the same key every time. – Peter Cordes Dec 28 '15 at 8:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.