3

I have lot's of passwords saved in Firefox Password Manager, now called Lockwise. I recently installed Opera Browser on my machine. It somehow managed to import all the history-data and form fields, such as username and passwords into the Opera's local database. As I understand, the username and passwords are send to the server e.g; Yahoo-Mail, in clear text via HTTPS. So Opera has to apply the credential information in the form fields in clear text.

So if Opera can get the passwords, any other harmful software might get it too right?

Am I missing something? So my final question is; Is Mozilla Firefox's Lockwise realy save?

  • Are you asked to enter your master password during import? If not, then there is nothing unordinary happening. On desktops, applications by default have access to every file which the user that launched a process has access to. If both browsers were launched by the same user, then they would have equal access to your filesystem. Files (including pictures, music, configuration files, and browser data) are owned by users. Files are not owned by applications. – Future Security Nov 11 '19 at 1:50
1

By default, Firefox only encrypts your passwords when stored on their servers for syncing between devices. If you want to also encrypt them locally so that other processes running in your user profile cannot read them, then you need to set a master password in the Firefox settings. I think this still needs to be done separately on every device.

This is a long-existing well-known drawback of storing your passwords in any major browser. They all (by default anyway) choose convenience over security and make the locally stored passwords easily available to any process running in the same user account on the local machine. Doing differently would require the user to type a password every time they launch the browser (or at least every time any remembered password is used) which I guess for the average user is too much trouble.

2

I have two big concerns with Lockwise.

  1. It doesn't auto-timeout/logout, so if an attacker gains access to your device, he/she also gains access to all of your passwords.

  2. Passwords stored in Lockwise are also stored in Firefox. A master password can add a layer of security to Firefox on a PC, but the mobile version of Firefox doesn't have this functionality, so anyone who gains access to your Firefox account will also gain access to your Lockwise passwords even if you have a master password set up on one of your devices. The biggest issue there is that when you sync your Firefox account to Firefox on a mobile device, it stays logged into your Firefox account, so all of your passwords are there for the taking for anyone who gets into your device.

Further exploration of your question: https://medium.com/@JoeKreydt/how-secure-is-firefox-lockwise-password-manager-51d44dcf4dbc?sk=dc7b81811044ebc08e4a77eb6c2fa8fd

1

Here is what Lockwise does:

PBKDF2 and HKDF with SHA-256 to create the encryption key from your Firefox accounts username and password.

So the encryption key is derived from your Firefox username and password. Since your credentials are cached to prevent you from signing in every time you use Lockwise, Opera presumably was able to access your database using those cached credentials - as would be an attacker. If Lockwise doesn't require your password, neither does a benign or malicious program, especially if the credentials are cached on the file-level. It's like encrypting a file and storing the password right next to it.

In that case a password manager that can be locked, or locks more frequently, then removes the decrypted data from memory, and requires the master password anew when unlocking the database may be a safer option.

Whether one or the other is "secure" depends in context on the type of threat you are trying to guard against. They can only be secure in respect to particular threats. Nevertheless, an existing route to directly and programmatically decrypt a password database on your local system offers more attack surface than one that requires your manual input of a master password.

  • You're right, so as I understand now, they compromise security for the sake of convenience. – StackUnderflow Nov 10 '19 at 18:54
0

Yes, it's safe. If your system were compromised badly enough that malware could read the password database file and steal your master password somehow, then even if you didn't use it, the same malware could just read each site's password as you type them in.

  • As I understand it, OP's scenario only requires read access on the file-level to obtain both master-key and database. It requires arguably more sophisticated access to read passwords as they are typed in. "Safe" is a relative term. – ig-dev Nov 10 '19 at 15:11
0

If it is "secure" depends on your analysis. Lockwise cloud storage appears to be secure.

The question of wether data should be protected against other programs is something that is comes up in the media and discussions quite frequently.

There are main schools of thought:

  • One, often levelled by third parties, is that access should be as hard as possible. Thus data should be locally encrypted and locked down as much as it can.
  • The other that there is no defence against an attacker who has access to your account anyway. Therefore it doesn't make sense to expend much effort against attacks by other programs running within your account.

Major browser vendors mostly go with the latter. Presumambly also with the idea that if you make password management easier then more people will use it - and this will be a greater security benefit overall.

Third-party password managers will often take additional measures to protect the local data, at the cost of additional hassle for the end user. Password management is always a tradeoff between convenience and security; and at the end of the day a using a reasonably secure password manager is much better than having a super-secure one and not using one.

For Lockwise, you can "secure" the local storage a bit by setting a master password.

None of the approaches is inherently "bad" though.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.