4 ms·

I don't understand why firefox doesn't use the underlying OS keyring like Chromium does. I can sort of understand why it currently doesn't (legacy code)... but

I don't understand why firefox doesn't use the underlying OS keyring like Chromium does. I can sort of understand why it currently doesn't (legacy code)... but why the lockbox extension instead of proper OS support? The more places your password is stored the greater the chance of one of them leaking them.

jcranmer 9y ago
As I understand it, using the OS keyring makes it impossible to do synchronization of the passwords (e.g., between mobile device and desktop).
- tacomonstrous 9y ago
  This can't be the explanation, since Chrome manages to sync passwords between devices.
  - staticassertion 9y ago
    Are you sure that Chrome uses keyring?
acdha 9y ago
There’s a long running ticket to do this on OS X which started out as NIH/apathy but gained a good reason not to as Apple restricted iCloud password support to App Store applications. https://bugzilla.mozilla.org/show_bug.cgi?id=152485 https://bugzilla.mozilla.org/show_bug.cgi?id=152485
- eridius 9y ago
  That ticket is marked as resolved and the last update is 16 years ago. Also this is the first I've heard that iCloud keychain sync only syncs keychain items created from App Store applications, and color me quite skeptical on that. Apple previously restricted the iCloud file and Key-Value Store functionality to App Store apps, but for keychain syncing it's just a single flag given to the item when creating it. Also I just checked the documentation for kSecAttrSynchronizable and there's no mention whatsoever of it being restricted to App Store apps.
  - acdha 9y ago
    Ack, sorry: that link should have been https://bugzilla.mozilla.org/show_bug.cgi?id=106400 https://bugzilla.mozilla.org/show_bug.cgi?id=106400 – I was hastily searching bugzilla on a phone. The iCloud issue is discussed towards the bottom and references the Chrome ticket to remove support: https://bugs.chromium.org/p/chromium/issues/detail?id=466638 https://bugs.chromium.org/p/chromium/issues/detail?id=466638
    - eridius 9y ago
      Thanks. It sounds like the real problem here is the fact that iCloud keychain doesn't have an access control list so apps can only access items within their same App Group, which means Firefox can't see Safari passwords and, if Firefox switches to iCloud keychain, no other browser can read passwords from Firefox. Though honestly this doesn't sound like a big deal to me (especially since the "Firefox can't see Safari passwords" is already the situation). The Chrome bug does claim that Mac apps could not use the keychain access groups entitlement without being in the App Store but I can't find any hint of that being true today. I believe Apple relaxed the iCloud restrictions at some point so it's possible that this used to be true and isn't anymore.
      - acdha 9y ago
        It mostly annoys me that we had at least 17 years where this relatively modest amount of code would have made a big security & usability benefit. Even if Apple eventually deprecated it, that’s a longer useful lifespan than an awful lot of code has.
huskyr 9y ago
Afaik, Chrome(ium) no longer has support for the Mac keychain and uses some kind of mechanism of its own :/
jrcii 9y ago
There was an extension that did precisely this until Mozilla decided to discontinue 50% of the useful Firefox addons with Firefox 58.
user5994461 9y ago
It doesn't help. All the passwords can be enumerated using the OS API. It would actually be a lot easier to gather passwords if all applications used the OS store.
- azinman2 9y ago
  But you still need to unlock the keychain to get those... so what’s the difference? If anything, the new iMac pro has a Secure Enclave, which means we can soon expect in some number of years that most computers will as well.
  - user5994461 9y ago
    Not correct. Unless you're specifically talking about some stuff by Apple. Do you know that windows has had password stores for many decades?
    - seandougall 9y ago
      Which part was not correct? macOS does indeed have, and has long had, a keychain API, if that’s the part you’re thinking of.
  - still_grokking 9y ago
    > If anything, the new iMac pro has a Secure Enclave, which means we can soon expect in some number of years that most computers will as well. I don't know about Macs but PCs have a Smart-Card like Chip called TPM build in for about 20 years by now. One of the main functions a TPM offers is the secure storage of encryption keys. I wonder such a feature comes only now to Macs with about two decades of a delay?
    - lclarkmichalek 9y ago
      I mean, TPMs only started appearing in laptops in the mid 2000s, but whatever. Unlike the TPM on most non-Apple laptops I've bought recently, the OSX secure enclave does significantly impact the security of the system. I don't know why Apple decided to create their own instead of using the standard TPM, but they've done a pretty good job of using it, unlike most other hardware vendors.

jcranmer 9y ago

As I understand it, using the OS keyring makes it impossible to do synchronization of the passwords (e.g., between mobile device and desktop).

tacomonstrous 9y ago
This can't be the explanation, since Chrome manages to sync passwords between devices.
- staticassertion 9y ago
  Are you sure that Chrome uses keyring?

acdha 9y ago

There’s a long running ticket to do this on OS X which started out as NIH/apathy but gained a good reason not to as Apple restricted iCloud password support to App Store applications. https://bugzilla.mozilla.org/show_bug.cgi?id=152485 https://bugzilla.mozilla.org/show_bug.cgi?id=152485

eridius 9y ago
That ticket is marked as resolved and the last update is 16 years ago. Also this is the first I've heard that iCloud keychain sync only syncs keychain items created from App Store applications, and color me quite skeptical on that. Apple previously restricted the iCloud file and Key-Value Store functionality to App Store apps, but for keychain syncing it's just a single flag given to the item when creating it. Also I just checked the documentation for kSecAttrSynchronizable and there's no mention whatsoever of it being restricted to App Store apps.
- acdha 9y ago
  Ack, sorry: that link should have been https://bugzilla.mozilla.org/show_bug.cgi?id=106400 https://bugzilla.mozilla.org/show_bug.cgi?id=106400 – I was hastily searching bugzilla on a phone. The iCloud issue is discussed towards the bottom and references the Chrome ticket to remove support: https://bugs.chromium.org/p/chromium/issues/detail?id=466638 https://bugs.chromium.org/p/chromium/issues/detail?id=466638
  - eridius 9y ago
    Thanks. It sounds like the real problem here is the fact that iCloud keychain doesn't have an access control list so apps can only access items within their same App Group, which means Firefox can't see Safari passwords and, if Firefox switches to iCloud keychain, no other browser can read passwords from Firefox. Though honestly this doesn't sound like a big deal to me (especially since the "Firefox can't see Safari passwords" is already the situation). The Chrome bug does claim that Mac apps could not use the keychain access groups entitlement without being in the App Store but I can't find any hint of that being true today. I believe Apple relaxed the iCloud restrictions at some point so it's possible that this used to be true and isn't anymore.
    - acdha 9y ago
      It mostly annoys me that we had at least 17 years where this relatively modest amount of code would have made a big security & usability benefit. Even if Apple eventually deprecated it, that’s a longer useful lifespan than an awful lot of code has.

huskyr 9y ago

Afaik, Chrome(ium) no longer has support for the Mac keychain and uses some kind of mechanism of its own :/

jrcii 9y ago

There was an extension that did precisely this until Mozilla decided to discontinue 50% of the useful Firefox addons with Firefox 58.

user5994461 9y ago

It doesn't help. All the passwords can be enumerated using the OS API. It would actually be a lot easier to gather passwords if all applications used the OS store.

azinman2 9y ago
But you still need to unlock the keychain to get those... so what’s the difference? If anything, the new iMac pro has a Secure Enclave, which means we can soon expect in some number of years that most computers will as well.
- user5994461 9y ago
  Not correct. Unless you're specifically talking about some stuff by Apple. Do you know that windows has had password stores for many decades?
  - seandougall 9y ago
    Which part was not correct? macOS does indeed have, and has long had, a keychain API, if that’s the part you’re thinking of.
- still_grokking 9y ago
  > If anything, the new iMac pro has a Secure Enclave, which means we can soon expect in some number of years that most computers will as well. I don't know about Macs but PCs have a Smart-Card like Chip called TPM build in for about 20 years by now. One of the main functions a TPM offers is the secure storage of encryption keys. I wonder such a feature comes only now to Macs with about two decades of a delay?
  - lclarkmichalek 9y ago
    I mean, TPMs only started appearing in laptops in the mid 2000s, but whatever. Unlike the TPM on most non-Apple laptops I've bought recently, the OSX secure enclave does significantly impact the security of the system. I don't know why Apple decided to create their own instead of using the standard TPM, but they've done a pretty good job of using it, unlike most other hardware vendors.