After I have entered my Master Password, does Firefox decrypt all the logins and store them somewhere? Or does it store the Master Password itself? Is the in-session period (more) vulnerable to attack?
Add a comment
|
1 Answer
The password database isn't encrypted directly with your master password, instead a hash of the master password is computed and that hash is used to encrypt/decrypt the password database.
After you typed your master password, Firefox doesn't store the plaintext password anymore and instead simply use the hashed password to access the file.
-
After entering my password the following files changed: webappstore.sqlite, webappstore.sqlite-wal, sessionstore-backups/recovery.jsonlz4. I guess it is possible the hashed password is kept in one of those, or in RAM. Would you say the latter to be more secure (harder to access)?– StockosMay 23, 2019 at 16:51
-
I think I understood wrongly. You say the hash is already in the file system, and that is used to decrypt the logins? If so, that doesn't seem to be secure at all...– StockosMay 23, 2019 at 16:57
-
@Stockos if you set a master password, the password hash is not stored in the filesystem. It's recomputed everytime you open the password database.– Lie RyanMay 23, 2019 at 23:25