24

I know that the file logins.json contains all my encrypted passwords in Firefox browser. How does Firefox encrypt these passwords if I don't use the 'Master Password' option? Does this mean key3.db file is used also if I didn't select Master Password?

Improve this question

2 Answers 2

Reset to default
25

When the profile is initialized, a blank password (an empty string) is used. You can find the code for this in toolkit/components/passwordmgr/crypto-SDR.js on line 64:

if (token.needsUserInit) {
  this.log("Initializing key3.db with default blank password.");
  token.initPassword("");
}

Additionally, based on the import method in toolkit/components/passwordmgr/LoginImport.jsm on line 68, the encrypted passwords are imported into logins.json from key3.db without modification. Therefore, they will be using the same default password.

Improve this answer
8
  • 1
    So basically all the passwords that firefox has cached are exposed? What about chrome?
    – Ant
    Dec 27, 2015 at 19:00
  • 9
    @Ant Most users do not use Firefox's "master password" feature to protect their stored passwords, so they would be at risk if their password file could be stolen. It is a trade-off between convenience and security.
    – Austin Hartzheim
    Dec 27, 2015 at 19:09
  • 6
    @Ant On Windows, Chrome encrypts the passwords with Windows DPAPI, which can be decrypted by any program running as the Windows user, unless the user's logon password is forcibly reset.
    – Ben N
    Dec 27, 2015 at 20:11
  • 1
    @AustinHartzheim thanks for your answer! I checked in logins.json and I saw that my passwords are not saved in clear text... so what is exactly the process done on the passwords? If I take for example the password 'pass123' how it will be saved in logins.json?
    – Hila
    Dec 28, 2015 at 7:41
  • 1
    @Hila: I guess Firefox doesn't optimize for the empty-password case by having extra code to skip the encrypting. As the code shows, they turn the empty string into a crypto key (somehow, doesn't matter how). There's no choice of key that will produce ciphertext = plaintext. All that matters is that the empty string produces the same key every time, just like any other string produces the same key every time.
    – Peter Cordes
    Dec 28, 2015 at 8:13
-1

AFAIK Firefox does not encrypt passwords unless you set a master password; instead it uses BASE64 to encode the data. That protects you from seeing the passwords when opening files with an editor, but it's trivial to get the original secrets.

Unfortunately Mozilla is not very open regarding the algorithms in use when a master password is set: You'll have to find out from the sources, I'm afarid.

Improve this answer
2
  • 2
    You claim something completely different from the current answer. Did it change? Do you have a link that verifies your claim? Because to my knowledge, it is indeed encrypted as the currently top voted answer says, not (only) base64 encoded. You are also making claims that they hide it, and while the info is not super easy to find, it's also not exactly as if they have anything to hide in an open source product... (Also, your German autocorrect is leaking ;-) "ist", "zu")
    – Luc
    Jul 11, 2019 at 7:37
  • I must admit that I haven't re-checked the "no master password" case in the last ten years ;-)
    – U. Windl
    Jul 11, 2019 at 8:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.