3

After I have entered my Master Password, does Firefox decrypt all the logins and store them somewhere? Or does it store the Master Password itself? Is the in-session period (more) vulnerable to attack?

Improve this question

1 Answer 1

Reset to default
1

The password database isn't encrypted directly with your master password, instead a hash of the master password is computed and that hash is used to encrypt/decrypt the password database.

After you typed your master password, Firefox doesn't store the plaintext password anymore and instead simply use the hashed password to access the file.

Improve this answer
3
  • After entering my password the following files changed: webappstore.sqlite, webappstore.sqlite-wal, sessionstore-backups/recovery.jsonlz4. I guess it is possible the hashed password is kept in one of those, or in RAM. Would you say the latter to be more secure (harder to access)?
    – Stockos
    May 23, 2019 at 16:51
  • I think I understood wrongly. You say the hash is already in the file system, and that is used to decrypt the logins? If so, that doesn't seem to be secure at all...
    – Stockos
    May 23, 2019 at 16:57
  • @Stockos if you set a master password, the password hash is not stored in the filesystem. It's recomputed everytime you open the password database.
    – Lie Ryan
    May 23, 2019 at 23:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .