2

What I want to do:
Use the "save password" feature in FireFox (on Windows 10) without using FireFox's master password feature.

What I'm afraid of:
Someone stealing my laptop or getting access to my hard drive in a different way without getting access to my Windows account password.

Approach:
Using EFS to encrypt the folder %AppData%/Mozilla/Firefox.

Additional information:
Firefox stores the passwords in a file called logins.json (located in the profile folder). They are encrypted but the secret to decrypt them is in a file called key4.db which is located in the same folder.

Is this a decent alternative to using FireFox's master password feature for the described situation and threat model?

Improve this question

1 Answer 1

Reset to default
2

For the specific scenario you outline (theft of your computer or hard disk), that will probably work. Note that EFS is based on your Windows password, and Windows' password hashing is incredibly weak by modern standards, so your password will need to be extremely good to prevent a dedicated attacker from brute-forcing the hash.

Additionally, EFS provides protection against a malicious (or compromised) program running in another user account on the same machine. If you care about that threat, then EFS is probably the way to go. However, be aware that EFS leaks some information about encrypted files (specifically, the file metadata like access time, file size, and so on) so make sure you don't care about that if you use EFS as your only layer of encryption.

A better option if you don't care about the same-machine-cross-user threat is BitLocker volume encryption. Although originally only available on the most expensive Windows editions and requiring hardware support, these days I think all Windows editions that support EFS also support BitLocker, and you can skip the TPM by using a boot-time password. This password is hashed far more securely than Windows user account password hashing. Additionally, BitLocker will also protect all the other sensitive data you might have outside of your web browser, like passwords/tokens stored in other desktop apps, documents, and multimedia files you keep electronically, and so on. There are lots of guides online for doing this; https://www.howtogeek.com/howto/6229/how-to-use-bitlocker-on-drives-without-tpm/ has a pretty good walk-through.

Improve this answer
1
  • +1 for Bitlocker recommendation. Encrypting the entire drive is far better than a single folder. Plus it prevents an attacker from installing malware or rootkits that can try to steal the data later when it is decrypted for use.
    – DoubleD
    Commented Oct 9, 2019 at 21:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .