Firefox bug permits stealing encrypted passwords: How is this possible?

Question

It's my understanding that passwords I save in Firefox's Password Manager are encrypted and that setting a Master Password encrypts the encryption key used in this process. The Google hit for "Does firefox encrypt saved passwords?" returns this Mozilla Support forum article in which the chosen answer (posted by a moderator) states:

The passwords stored in logins.json are encrypted, but the encryption key is stored in key4.db (previously in key3.db) and without a master password you merely need to place the two files is Firefox profile folder to see the passwords in the Password Manager.

(Note that logins.json is where FF stores passwords.)

This Information Security question posted by a high rep user assumes the encryption of the passwords, even before a user has set a Master Password, as does this well-received question.

But according to the Sophos Naked Security article, Firefox fixes “master password” security bypass bug, Mozilla released a security fix to resolve an issue where an attacker can copy saved passwords to the clipboard without entering the Master Password:

It was found that locally stored passwords can be copied to the clipboard thorough the ‘copy password’ context menu item without first entering the master password, allowing for potential theft of stored passwords.

How is this possible if the passwords are encrypted?

Isn't the Master Password, needed to decrypt them before access? I'm very worried now that an attacker that gains access to my logins.json and key4.db files would have all my saved passwords!

Answer 1

If you have no master password set, then the login passwords are always available. If you do have a master password set, then opening the Saved Logins dialog will prompt you for the master password. Without the correct master password, the list of logins will be empty and thus there is no password to copy.

The bug only occurs in this specific condition:

• A master password is set.
• You have unlocked your logins by entering the master password once this browsing session.

To be clear: if you have a master password set, and have not unlocked your logins this session, your passwords will still be protected and not be available through this bug.

Passwords are stored encrypted on disk, protected by a key derived from the master password. If you start Firefox for the first time, it will usually prompt you only once for your master password when it encounters a login form, or when you open the Saved Logins section. If you dismiss this request, the logins will not be available. If you however enter the password, the decrypted passwords will be available until you quit Firefox.

Normally, when you use the Show Passwords button, or if you right-click a login and chose Copy Password, it will prompt you for the password once again. Due to the bug, the password confirmation prompt was displayed, but the password was already being copied in the background.

The impact is very low in my opinion. Someone with physical access to your unlocked session can already obtain the password in other ways:

1. Visit the website, for example, https://stackoverflow.com/users/login
2. Observe that the login is filled in.
3. Open Developer Tools (F12), go to Console.
4. Execute: document.querySelector("input[type=password]").value
5. Observe the password.

Alternatively, you could go to the Network tab in Developer Tools. Press Login and observe the password being recorded. There are plenty of methods to obtain the logins if it is already filled in.

As for the commit that references the bug, the code defect was that an asynchronous call (masterPasswordLogin()) was not waited for. That is why the code to copy the password is already executed before the login prompt was confirmed. The fix is to wait for the prompt to be completed.

The original security advisory from Mozilla only stated that passwords can be copied without entry of the master password. Since then, this security advisory has been updated with the above clarification, and now reads:

When a master password is set, it is required to be entered again before stored passwords can be accessed in the 'Saved Logins' dialog. It was found that locally stored passwords can be copied to the clipboard thorough the 'copy password' context menu item without re-entering the master password if the master password had been previously entered in the same session, allowing for potential theft of stored passwords.