0

Is it really that simple?

I guess having a master password will prevent that, but the drawback is that it is asked each time I open the web browser.

Improve this question

1 Answer 1

Reset to default
2

Welcome to the real world! The master password on Firefox passwords is not different than the lock on the front door of your home: if you use it to prevent others to enter without permission, you will have to consistently unlock it to enter your home and lock it when you go out.

There is no magic here: you have to decide what protections you use and if possible ensure that they are relevant according to the expected risk and threat. If you think that the threat level is very low, you could even decide that the physical lock on your front door is enough to protect your computer and its content. And it is not a joke, because systems not connected to any network and only used to control mechanical automates need no special security beyond the physical access. And I must admit that my personal computer only has a trivial password because I know that if a attacker puts its hands on it, leaking photos of my familly will be be the least problem. But my password vault has a strong password because leaking it would give access to my bank accounts.

So it is up to you to decide what level of threat and risk you want to accept. But if you have no master password on Firefox, yet store passwords in it, anybody having an access to the config is able to steal all of them along with the site they are related.

Improve this answer
2
  • 1
    Your password vault only has the same level of protection than the computer holding it. If someone gets (physical or remote) access to your computer and is able to tamper with the OS, they can easily copy the vault & decrypt it later with a password stolen using a keylogger.
    – Esa Jokinen
    Feb 9 at 10:05
  • @EsaJokinen: You are right on that point: if the computer is badly compromissed, the vault will no longer be secure. That is the reason why I have other defense lines (up to date anti-virus, strong lock on my front door, etc.). The strong master password is only a second defense line: if somebody breaks into my house and steal my computer, I should be able to notice it and just want to have enough time to change my important passwords. I do not pretend to be protected against all possible threats, I just say that I have identified a number of them and chosed the acceptable risk level.
    – Serge Ballesta
    Feb 9 at 10:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.