I am wondering how safe are my passwords stored in the passwords manager built into Mozilla Firefox. Currently I am using Firefox Quantum 59.0.2 64-bit under Ubuntu 16.04 in one machine. I guess reasons to be concerned about may be various, e.g.:
- Other software having access to the filesystem.
My focus is now on item 1, and I guess here it is irrelevant which OS I am using, but only the version of FF (is this correct?).
My questions are:
- What are the possible mechanisms an add-on can have to: a) read, b) exfiltrate my passwords?
- What are the easiest ways to make sure (or against the lack of that, arbitrarily trusting somewhat) that is not happening, in each case? I emphasize easiest since, I guess, an extreme answer like "become a specialist in security and code development, and read the add-on code" is always valid... I mean to apply solutions as easy as possible.
- Why wouldn't it be possible to have the same security level with FF as with Keepass (e.g.), if the same encryption algorithm were used? (in Security on passwords stored by Firefox vs password manager I ask about a comparison of algorithms, which is a separate issue).
Related info, which I didn't find it answers the question: