I know that the file logins.json
contains all my encrypted passwords in Firefox browser. How does Firefox encrypt these passwords if I don't use the 'Master Password' option? Does this mean key3.db
file is used also if I didn't select Master Password?
2 Answers
When the profile is initialized, a blank password (an empty string) is used. You can find the code for this in toolkit/components/passwordmgr/crypto-SDR.js
on line 64:
if (token.needsUserInit) {
this.log("Initializing key3.db with default blank password.");
token.initPassword("");
}
Additionally, based on the import
method in toolkit/components/passwordmgr/LoginImport.jsm
on line 68, the encrypted passwords are imported into logins.json
from key3.db
without modification. Therefore, they will be using the same default password.
-
1So basically all the passwords that firefox has cached are exposed? What about chrome?– AntDec 27, 2015 at 19:00
-
9@Ant Most users do not use Firefox's "master password" feature to protect their stored passwords, so they would be at risk if their password file could be stolen. It is a trade-off between convenience and security. Dec 27, 2015 at 19:09
-
6@Ant On Windows, Chrome encrypts the passwords with Windows DPAPI, which can be decrypted by any program running as the Windows user, unless the user's logon password is forcibly reset.– Ben NDec 27, 2015 at 20:11
-
1@AustinHartzheim thanks for your answer! I checked in logins.json and I saw that my passwords are not saved in clear text... so what is exactly the process done on the passwords? If I take for example the password 'pass123' how it will be saved in logins.json?– HilaDec 28, 2015 at 7:41
-
1@Hila: I guess Firefox doesn't optimize for the empty-password case by having extra code to skip the encrypting. As the code shows, they turn the empty string into a crypto key (somehow, doesn't matter how). There's no choice of key that will produce ciphertext = plaintext. All that matters is that the empty string produces the same key every time, just like any other string produces the same key every time. Dec 28, 2015 at 8:13
AFAIK Firefox does not encrypt passwords unless you set a master password; instead it uses BASE64 to encode the data. That protects you from seeing the passwords when opening files with an editor, but it's trivial to get the original secrets.
Unfortunately Mozilla is not very open regarding the algorithms in use when a master password is set: You'll have to find out from the sources, I'm afarid.
-
2You claim something completely different from the current answer. Did it change? Do you have a link that verifies your claim? Because to my knowledge, it is indeed encrypted as the currently top voted answer says, not (only) base64 encoded. You are also making claims that they hide it, and while the info is not super easy to find, it's also not exactly as if they have anything to hide in an open source product... (Also, your German autocorrect is leaking ;-) "ist", "zu")– LucJul 11, 2019 at 7:37
-
I must admit that I haven't re-checked the "no master password" case in the last ten years ;-)– U. WindlJul 11, 2019 at 8:20