25

I know that the file logins.json contains all my encrypted passwords in Firefox browser. How does Firefox encrypt these passwords if I don't use the 'Master Password' option? Does this mean key3.db file is used also if I didn't select Master Password?

Improve this question

2 Answers 2

Reset to default
25

When the profile is initialized, a blank password (an empty string) is used. You can find the code for this in toolkit/components/passwordmgr/crypto-SDR.js on line 64:

if (token.needsUserInit) {
  this.log("Initializing key3.db with default blank password.");
  token.initPassword("");
}

Additionally, based on the import method in toolkit/components/passwordmgr/LoginImport.jsm on line 68, the encrypted passwords are imported into logins.json from key3.db without modification. Therefore, they will be using the same default password.

Improve this answer
5
  • 9
    @Ant Most users do not use Firefox's "master password" feature to protect their stored passwords, so they would be at risk if their password file could be stolen. It is a trade-off between convenience and security.
    – Austin Hartzheim
    Commented Dec 27, 2015 at 19:09
  • 6
    @Ant On Windows, Chrome encrypts the passwords with Windows DPAPI, which can be decrypted by any program running as the Windows user, unless the user's logon password is forcibly reset.
    – Ben N
    Commented Dec 27, 2015 at 20:11
  • 1
    @Hila: I guess Firefox doesn't optimize for the empty-password case by having extra code to skip the encrypting. As the code shows, they turn the empty string into a crypto key (somehow, doesn't matter how). There's no choice of key that will produce ciphertext = plaintext. All that matters is that the empty string produces the same key every time, just like any other string produces the same key every time.
    – Peter Cordes
    Commented Dec 28, 2015 at 8:13
  • @Hila The reason they appear encrypted (as Peter points out) is that the default blank string still acts as an encryption key in their algorithm. This obfuscates the passwords which provides a small amount of protection, especially on shared computers.
    – Austin Hartzheim
    Commented Dec 28, 2015 at 15:13
  • @AustinHartzheim But when I try to decrypt this password using 3DES with this default blank string I didn't get my password...
    – Hila
    Commented Dec 28, 2015 at 15:36
-1

AFAIK Firefox does not encrypt passwords unless you set a master password; instead it uses BASE64 to encode the data. That protects you from seeing the passwords when opening files with an editor, but it's trivial to get the original secrets.

Unfortunately Mozilla is not very open regarding the algorithms in use when a master password is set: You'll have to find out from the sources, I'm afarid.

Improve this answer
2
  • 2
    You claim something completely different from the current answer. Did it change? Do you have a link that verifies your claim? Because to my knowledge, it is indeed encrypted as the currently top voted answer says, not (only) base64 encoded. You are also making claims that they hide it, and while the info is not super easy to find, it's also not exactly as if they have anything to hide in an open source product... (Also, your German autocorrect is leaking ;-) "ist", "zu")
    – Luc
    Commented Jul 11, 2019 at 7:37
  • I must admit that I haven't re-checked the "no master password" case in the last ten years ;-)
    – U. Windl
    Commented Jul 11, 2019 at 8:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .