4

I'm using Firefox with Sync on different PC's and master password is set from very beginning when I first started to use Firefox.

Today I installed Firefox for Android, authorized in Firefox Sync, opened logins tab, pressed "Show password" button expecting input form for my master password and.. I saw my password. And all others.

The master password was never typed on the android's keyboard. Firefox was never installed on the phone before. How does this possible? How to prevent this?

  • When you say you authorized in Firefox Sync, you were asked for some form of credentials linked to your Firefox account, correct? Was this not your master password, or just a password for your Firefox account? Either way, this may have been enough to authorize access to your passwords. The best way to prevent this may be to use a 3rd party password manager that is not integrated with the browser. – INV3NT3D Aug 22 '16 at 14:41
  • 1
    It was the password for Firefox account, which differ from the master password. I'm mad because keydb should be encrypted with master password which is stored in my head only which guarantee that nobody can read my passwords without thermorectal cryptoanalysis even if they steal keydb. What's the point of master password otherwise? – meownoid Aug 22 '16 at 16:45
  • 1
    And Mozilla says they not store master password. Which seems not to be true. – meownoid Aug 22 '16 at 16:47
5

There's two different concepts at play here:

  1. You Firefox Sync account
  2. The master password (the login manager)

Number 2 is independent of whether you use Sync or not. It's a password protection for the local storage of saved passwords.

It used to be that when you had a master password on a device, Sync would not synchronize saved passwords on that device.

This was changed around Firefox 34. Apparently now when your MP is unlocked it will sync the saved passwords to your account. When it's not unlocked it will silently do nothing unless you explicitly ask it to "Sync Now".

So think about the master password as a local-only protection, the synced data is already protected by other means on Firefox Sync's servers (your account credentials).

As pointed out by @Ben:

It's worth noting explicitly here that the synced passwords are not just "protected" with your sync password; it's encrypted using them. So be sure the sync password is strong! The other thing that means is that you will lose any synced passwords if you reset your sync password via "forgot my password", because Mozilla cannot decrypt them without your sync password. But the assumption in that case is, that you still have your local copy, so you should be OK

This applies to all sync data, not just passwords, and is thoroughly documented at Mozilla's GitHub.

If you want you can disable saved password sync from Sync's options.

  • 1
    It's worth noting explicitly here that the synced passwords are not just "protected" with your sync password; it's encrypted using them. So be sure the sync password is strong! The other thing that means is that you will lose any synced passwords if you reset your sync password via "forgot my password", because Mozilla cannot decrypt them without your sync password. But the assumption in that case is, that you still have your local copy, so you should be OK. Mozilla does a decent job documenting all this if you need details. :-) – Ben Aug 30 '16 at 18:21
  • @Ben you're correct. I added it to my answer, hope you don't mind :-) – GnP Sep 2 '16 at 14:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.