10

It's my understanding that passwords I save in Firefox's Password Manager are encrypted and that setting a Master Password encrypts the encryption key used in this process. The Google hit for "Does firefox encrypt saved passwords?" returns this Mozilla Support forum article in which the chosen answer (posted by a moderator) states:

The passwords stored in logins.json are encrypted, but the encryption key is stored in key4.db (previously in key3.db) and without a master password you merely need to place the two files is Firefox profile folder to see the passwords in the Password Manager.

(Note that logins.json is where FF stores passwords.)

This Information Security question posted by a high rep user assumes the encryption of the passwords, even before a user has set a Master Password, as does this well-received question.

But according to the Sophos Naked Security article, Firefox fixes “master password” security bypass bug, Mozilla released a security fix to resolve an issue where an attacker can copy saved passwords to the clipboard without entering the Master Password:

It was found that locally stored passwords can be copied to the clipboard thorough the ‘copy password’ context menu item without first entering the master password, allowing for potential theft of stored passwords.

How is this possible if the passwords are encrypted?

Isn't the Master Password, needed to decrypt them before access? I'm very worried now that an attacker that gains access to my logins.json and key4.db files would have all my saved passwords!

  • 1
    What they actually wanted to say, it seems, is “that locally stored passwords can be copied to the clipboard […] without first entering the master password” again. – caw Aug 18 at 19:05
  • 1
    The Ubuntu security notice (USN-4101-1) for this bug uses quite similar language, perhaps by the same author or based on the same source, and is equally ambiguous: usn.ubuntu.com/4101-1 – caw Aug 18 at 19:09
14

If you have no master password set, then the login passwords are always available. If you do have a master password set, then opening the Saved Logins dialog will prompt you for the master password. Without the correct master password, the list of logins will be empty and thus there is no password to copy.

The bug only occurs in this specific condition:

  • A master password is set.
  • You have unlocked your logins by entering the master password once this browsing session.

To be clear: if you have a master password set, and have not unlocked your logins this session, your passwords will still be protected and not be available through this bug.

Passwords are stored encrypted on disk, protected by a key derived from the master password. If you start Firefox for the first time, it will usually prompt you only once for your master password when it encounters a login form, or when you open the Saved Logins section. If you dismiss this request, the logins will not be available. If you however enter the password, the decrypted passwords will be available until you quit Firefox.

Normally, when you use the Show Passwords button, or if you right-click a login and chose Copy Password, it will prompt you for the password once again. Due to the bug, the password confirmation prompt was displayed, but the password was already being copied in the background.

Screenshot of Saved Logins

The impact is very low in my opinion. Someone with physical access to your unlocked session can already obtain the password in other ways:

  1. Visit the website, for example, https://stackoverflow.com/users/login
  2. Observe that the login is filled in.
  3. Open Developer Tools (F12), go to Console.
  4. Execute: document.querySelector("input[type=password]").value
  5. Observe the password.

Alternatively, you could go to the Network tab in Developer Tools. Press Login and observe the password being recorded. There are plenty of methods to obtain the logins if it is already filled in.

As for the commit that references the bug, the code defect was that an asynchronous call (masterPasswordLogin()) was not waited for. That is why the code to copy the password is already executed before the login prompt was confirmed. The fix is to wait for the prompt to be completed.

The original security advisory from Mozilla only stated that passwords can be copied without entry of the master password. Since then, this security advisory has been updated with the above clarification, and now reads:

When a master password is set, it is required to be entered again before stored passwords can be accessed in the 'Saved Logins' dialog. It was found that locally stored passwords can be copied to the clipboard thorough the 'copy password' context menu item without re-entering the master password if the master password had been previously entered in the same session, allowing for potential theft of stored passwords.

  • 1
    Do you have a reference for the second bullet point? That pivotal mitigating factor is not mentioned in the security advisory. In fact it says passwords can be copied to the clipboard thorough the 'copy password' context menu item without first entering the master password. – Twisty Impersonator Aug 18 at 16:09
  • 1
    I reproduced the issue in 68.0.1 and can confirm the scenario. The code fix referenced at the end of the answer is also obvious to a programmer. The problem is indeed that the password can be copied, even after dismissing the master password confirmation dialog. However, before this can happen, you must have already entered your master password at least once since the browser started. Is there something unclear about the answer? – Lekensteyn Aug 18 at 16:15
  • 1
    Your answer is clear, however I would like an official reference from Mozilla confirming your research. I don't see where they say the bug only exists after having entered the matter password at least once. (Though perhaps it's just a poorly-worded advisory.) – Twisty Impersonator Aug 18 at 16:18
  • 1
    @TwistyImpersonator This answer is correct, and the phrasing of the official advisory has now been updated to be more precise. Take a look at: mozilla.org/en-US/security/advisories/mfsa2019-24 – Rob W Aug 19 at 19:36
  • Excellent answer. Well done. – Twisty Impersonator Aug 20 at 22:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.