9

If you ask Mozilla Firefox to remember the login details for a website, the credentials will be stored in your profile directory in Logins.json.

Instead of storing plaintext values, the username and password will be encrypted (using the PKCS #11 API implemented in Mozilla's NSS library). However, the key required to decrypt them is also stored in your profile directory (in Key3.db). Therefore, an attacker who acquires that directory will obviously also be able to extract the stored passwords (that is, unless the owner has set a master password).

This got me curious: What was the motivation to encrypt the passwords in Logins.json by default when the key is stored nearby? In which realistic scenario could this design decision complicate an attack?

  • 5
    If you set a master password, the information in Key3.db does not allow you to decrypt the passwords if you do not know the master password. – Anders May 29 '16 at 22:49
  • 1
    Maybe Logins.json is also used for synchronizing the passwords when logged into Firefox sync, in which case Key3.db would not leave the local machine. Does anyone know more? – Potaito May 30 '16 at 11:40
  • 1
    Why aren't you using a master password so the security is complete? So the question should more likely be, "Why doesn't Firefox by default, explain the need for, and ask for a Master Password?" – Fiasco Labs May 31 '16 at 3:09
6

It's probably to simplify the implementation. Rather than having two cases where the key store could be encrypted or not depending on whether Master Password is set, the code always encrypts.

This reduces the likelihood that a code path that forgets to encrypt when Master Password is enabled goes unnoticed.

  • 1
    I ignored that the default case simply simulates an empty master password. You are right in that this is likely a convenient implementation rather than a specific security measure. – Arminius May 31 '16 at 16:20
3

I'd say that the reason is to obfuscate the stored passwords, and that the "remember websites passwords" feature in Firefox is supposed to be always used with a master key.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.