I know that the file logins.json contains all my encrypted passwords in Firefox browser. How does Firefox encrypt these passwords if I don't use the 'Master Password' option? Does this mean key3.db file is used also if I didn't select Master Password?
23
25
When the profile is initialized, a blank password (an empty string) is used. You can find the code for this in toolkit/components/passwordmgr/crypto-SDR.js on line 64:
if (token.needsUserInit) {
this.log("Initializing key3.db with default blank password.");
token.initPassword("");
}
Additionally, based on the import method in toolkit/components/passwordmgr/LoginImport.jsm on line 68, the encrypted passwords are imported into logins.json from key3.db without modification. Therefore, they will be using the same default password.
-
1So basically all the passwords that firefox has cached are exposed? What about chrome? – Ant Dec 27 '15 at 19:00
-
9@Ant Most users do not use Firefox's "master password" feature to protect their stored passwords, so they would be at risk if their password file could be stolen. It is a trade-off between convenience and security. – Austin Hartzheim Dec 27 '15 at 19:09
-
5@Ant On Windows, Chrome encrypts the passwords with Windows DPAPI, which can be decrypted by any program running as the Windows user, unless the user's logon password is forcibly reset. – Ben N Dec 27 '15 at 20:11
-
@AustinHartzheim thanks for your answer! I checked in logins.json and I saw that my passwords are not saved in clear text... so what is exactly the process done on the passwords? If I take for example the password 'pass123' how it will be saved in logins.json? – Hila Dec 28 '15 at 7:41
-
1@Hila: I guess Firefox doesn't optimize for the empty-password case by having extra code to skip the encrypting. As the code shows, they turn the empty string into a crypto key (somehow, doesn't matter how). There's no choice of key that will produce ciphertext = plaintext. All that matters is that the empty string produces the same key every time, just like any other string produces the same key every time. – Peter Cordes Dec 28 '15 at 8:13
