7

I'm using Firefox with Sync on different PC's and master password is set from very beginning when I first started to use Firefox.

Today I installed Firefox for Android, authorized in Firefox Sync, opened logins tab, pressed "Show password" button expecting input form for my master password and.. I saw my password. And all others.

The master password was never typed on the android's keyboard. Firefox was never installed on the phone before. How does this possible? How to prevent this?

Improve this question
3
  • When you say you authorized in Firefox Sync, you were asked for some form of credentials linked to your Firefox account, correct? Was this not your master password, or just a password for your Firefox account? Either way, this may have been enough to authorize access to your passwords. The best way to prevent this may be to use a 3rd party password manager that is not integrated with the browser.
    – INV3NT3D
    Aug 22, 2016 at 14:41
  • 1
    It was the password for Firefox account, which differ from the master password. I'm mad because keydb should be encrypted with master password which is stored in my head only which guarantee that nobody can read my passwords without thermorectal cryptoanalysis even if they steal keydb. What's the point of master password otherwise?
    – meownoid
    Aug 22, 2016 at 16:45
  • 1
    And Mozilla says they not store master password. Which seems not to be true.
    – meownoid
    Aug 22, 2016 at 16:47

1 Answer 1

Reset to default
6

There's two different concepts at play here:

  1. You Firefox Sync account
  2. The master password (the login manager)

Number 2 is independent of whether you use Sync or not. It's a password protection for the local storage of saved passwords.

It used to be that when you had a master password on a device, Sync would not synchronize saved passwords on that device.

This was changed around Firefox 34. Apparently now when your MP is unlocked it will sync the saved passwords to your account. When it's not unlocked it will silently do nothing unless you explicitly ask it to "Sync Now".

So think about the master password as a local-only protection, the synced data is already protected by other means on Firefox Sync's servers (your account credentials).

As pointed out by @Ben:

It's worth noting explicitly here that the synced passwords are not just "protected" with your sync password; it's encrypted using them. So be sure the sync password is strong! The other thing that means is that you will lose any synced passwords if you reset your sync password via "forgot my password", because Mozilla cannot decrypt them without your sync password. But the assumption in that case is, that you still have your local copy, so you should be OK

This applies to all sync data, not just passwords, and is thoroughly documented at Mozilla's GitHub.

If you want you can disable saved password sync from Sync's options.

Improve this answer
2
  • 1
    It's worth noting explicitly here that the synced passwords are not just "protected" with your sync password; it's encrypted using them. So be sure the sync password is strong! The other thing that means is that you will lose any synced passwords if you reset your sync password via "forgot my password", because Mozilla cannot decrypt them without your sync password. But the assumption in that case is, that you still have your local copy, so you should be OK. Mozilla does a decent job documenting all this if you need details. :-)
    – Ben
    Aug 30, 2016 at 18:21
  • @Ben you're correct. I added it to my answer, hope you don't mind :-)
    – GnP
    Sep 2, 2016 at 14:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .