11

I have just migrated from LastPass to default Firefox Password Manager and Firefox Sync. I have some doubts about using Firefox Password Manager and Firefox Sync. Let's assume I don't use a master password:

  1. can a Firefox addon access and read my saved passwords and somehow steal them from me (so the person/people who created the addon can view my passwords)? (e.g. I use this addon)
  2. can a Firefox addon access and read my saved passwords stored with Firefox Sync and somehow steal them from me (so the person/people who created the addon can view my passwords)?
  3. is Firefox Sync better than LastPass when considering security? Can I trust their servers? How does Firefox Sync security work?
  4. If I don't use a master password in Firefox Password Manager is it true that the only way for someone to steal my passwords is by accessing my filesystem, so both websites and addons can't view my passwords without my permission (refer to 1. and 2.)?

Thanks

5
  1. Obviously, yes. Addons can access the saved passwords. You yourself are using an add-on that can save, read, and edit passwords. I'm not really sure why this is part of your question. Regardless, even without this ability, addons often use access to website content to do same legitimate task. It would not be hard to also scrape text from password fields.
  2. Yes. Synchronized passwords are no different from other saved passwords. They all get saved to the same place and they all get synchronized if you turn the option on.
  3. As far as I can tell, the security model is about the same, if you use a master password. You encrypt locally, so anyone breaking into the server will need to break your master password to read any login credentials. Without a master password, Mozilla still encrypts your passwords using your sync account password, so even if data is stolen from Mozilla's servers, your passwords should be as safe, if your Sync password is strong. Of course if the break into Mozilla they'll get a lot more information than just passwords (e.g. synchronized bookmarks, saved browsing history, etc.) I don't think anyone is really qualified to compare security practices between the two, unless they've done pen-testing with both or something. As for user security, I think LastPass supports 2-factor authentication, so they may even get the win in security, if you use that feature. That said... LastPass has had at least two breaches I've heard about, whereas Mozilla has had none I know about. So ¯\_(ツ)_/¯.
  4. In a sense, yes, local access is needed. Considering the encryption discussed above, Mozilla never has your password data in usable form. But local access could be any program running as your user account, or any Firefox add-on, as discussed above. With a master password, Firefox must be running with your master password entered, or your master password must be stolen with a key logger. Without a master password your saved passwords can be read at any time by programs running on your device. If your full disk is not encrypted, and you don't securely erase/destroy it when you discard your device, your saved passwords can be obtained from there as well if you do not use a master password. Same story for any disk backup storage you may use. More common sources of leaks are people accidentally posting them publicly along with their other Firefox config data when trying to get support or backing up their user directory or something. So I guess the answer here depends on what you're trying to protect against.
  • 2
    "Addons can access the saved passwords", ok so how can I know whether one of my addons (and so the people behind it) are reading my passwords and maybe stealing them from me? – Frank Aug 16 '16 at 7:02
  • 3
    You don't. You just choose to trust the authors and the Mozilla team who reviews each signed version, or you choose not to and don't install the add-on. Just like any other executable you may install on your computer. – Ben Aug 16 '16 at 11:58
  • 1
    @Frank You can have a separate Firefox profile for your work related stuff and install only bare minimum of addons on that profile. Profiles are so useful but a weirdly hidden feature. You can manage them from the about:profiles page and by opening firefox with firefox -ProfileManager -no-remote (via Cmd-R in Windows or via terminal in Linux/Mac) – ossbuntu Oct 31 '17 at 11:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.