2

In short I'm wondering what's stopping someone with access to my computer account to exploit an open Firefox Sync session to view my synced passwords, even if a Master Password has been set.

On this page Mozilla says:

Even though the Password Manager stores your usernames and passwords on your hard drive in an encrypted format, someone with access to your computer user profile can still see or use them. The Use a Master Password to protect stored logins and passwords article shows you how to prevent this and keep you protected in the event your computer is lost or stolen.

In other words, the Master Password is presented as a solution for protecting my passwords even if someone has access to my computer user profile. One example of giving others access to my computer user profile would be if I had a weak or no password for my Windows user account, and then lost the computer, if I understand correctly.

When I have Firefox Sync enabled and I'm logged in, but don't have a Master Password set, I can freely enable and disable syncing my passwords from Mozilla's servers. It's basically a checkbox that allows me to download my passwords whenever I want, and the passwords are immediately viewable as long as I am logged into my Windows user account.

The Sync and Master Password are presented as being fairly independent features, which leads me to my question: since the Master Password is local to my machine, aren't my passwords requested in the same way from Mozilla's servers as if the Master Password had not been set? If so, then how does the Master Password protect my synced passwords from people with access to my computer user profile if those people already have access to my Firefox Sync session?

Is the Sync session's credentials now protected with the Master Password as well? Sorry if the answer is obvious, it isn't immediately apparent to me from my day to day use of Firefox.

Improve this question
2
  • Hi. The security model of Firefox Sync was explained by Mozilla. blog.mozilla.org/services/2014/04/30/…
    – A. Hersean
    Apr 29, 2019 at 13:25
  • @A.Hersean Thanks for the link, although I read that before writing the question. Number of times "master password" is mentioned in that post: zero. If you feel that there is a quote in it that answers this question I'd be grateful if you put it in an answer!
    – Andreas
    Apr 29, 2019 at 14:53

1 Answer 1

Reset to default
3

According to Firefox Help - Recovering important data from an old profile: Your passwords are stored in a JSON file that has encrypted entries, the keys are within a sqlite database.

  1. key4.db - This file stores your key database for your passwords.
  2. logins.json - Saved passwords.

So if sync is active and working with a attacker, you are vulnerable to this, luckily the sync service requires a password. https://support.mozilla.org/en-US/kb/using-master-password-sync

The so-called 'master password' does not protect your passwords, it just blocks someone from grabbing it remotely.

Improve this answer
7
  • I found it a bit hard to understand "So if sync is active and working with a attacker, you are vulnerable to this" -- is that hypothetical, as in if the session were open (but it can't be unless you've already entered the Master Password)? "luckily the sync service requires a password" -- if I understand you correctly, you refer to a password that only exists within the store that is itself protected by the Master Password. Your link seems to have exactly what I was looking for: "When using Sync, your Firefox Accounts login is stored with your saved passwords in the password manager"
    – Andreas
    Apr 30, 2019 at 18:44
  • Yes sir, you got the correct idea. The "master password" just acts as a software blockade, but after this is past, security within the service is minimalist and legacy at best.
    – Belle 'Sandon' Ling
    Apr 30, 2019 at 18:54
  • It'd be nice if you could clarify "The so-called 'master password' does not protect your passwords, it just blocks someone from grabbing it remotely". I was under the impression that the Master Password encrypts my passwords locally -- how does that not protect them when my hard drive ends up in the wrong hands? And in what way does that encryption block a remote attacker more than a local attacker (e.g. if someone stole my computer)?
    – Andreas
    Apr 30, 2019 at 19:37
  • @Andreas Unfortunately, it does not, if someone has access to your filesystem it is compressible. Luckily attackers can only remotely access your hard drive through Firefox sync, which requires a password to login. However, you can evade this by encrypting your hard drive with Windows BitLocker.
    – Belle 'Sandon' Ling
    Apr 30, 2019 at 19:41
  • 1
    Do you have a reference for that? Because storing the master password on disk sounds plain idiotic.
    – Andreas
    Apr 30, 2019 at 23:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .