If you ask Mozilla Firefox to remember the login details for a website, the credentials will be stored in your profile directory in
Instead of storing plaintext values, the username and password will be encrypted (using the PKCS #11 API implemented in Mozilla's NSS library). However, the key required to decrypt them is also stored in your profile directory (in
Key3.db). Therefore, an attacker who acquires that directory will obviously also be able to extract the stored passwords (that is, unless the owner has set a master password).
This got me curious: What was the motivation to encrypt the passwords in
Logins.json by default when the key is stored nearby? In which realistic scenario could this design decision complicate an attack?