5 ms·

Are Firefox passwords encrypted on the client? I currently use (any pay for) Bitwarden and I like that the code is open and my data is encrypted on the client

Are Firefox passwords encrypted on the client? I currently use (any pay for) Bitwarden and I like that the code is open and my data is encrypted on the client and only synced with the server. I'd like a similar service from Mozilla, but don't know how the encryption is handled.

sciurus 8y ago
Yes, they are encrypted on the client. https://blog.mozilla.org/services/2014/04/30/firefox-syncs-new-security-model/ https://blog.mozilla.org/services/2014/04/30/firefox-syncs-n... https://github.com/mozilla/fxa-auth-server/wiki/onepw-protocol https://github.com/mozilla/fxa-auth-server/wiki/onepw-protoc...
zokier 8y ago
If you have master password set in the browser then the password db is encrypted locally. I remember there being some noise about it not being very secure encryption, so better check the details if that is critical for you. As for the Firefox Accounts/Sync stuff, afaik MozCo servers see only encrypted content. https://medium.com/mozilla-tech/how-firefox-sync-keeps-your-secrets-if-tls-fails-14420d45885c https://medium.com/mozilla-tech/how-firefox-sync-keeps-your-... might provide more insight
woodrowbarlow 8y ago
as others have said, it's encrypted if you enable the "master password" option; however, the ux of the master password is miserable: * the prompt for entering your master password is a simple dialog, with "ok" and "cancel" buttons. a website could probably trigger an identical prompt with javascript to phish your master password. * the prompt pops up once when you first start the browser (about 15-30 seconds after everything is loaded) and then (if you dismiss it with "cancel") again each time you visit a site for which you have a saved password. there's no way to trigger the unlock prompt on-demand. * the master password doesn't have a timeout. once you've unlocked the keychain, it remains unlocked until you restart the browser. don't bother. stick with whatever third-party extension you're using.

sciurus 8y ago

Yes, they are encrypted on the client. https://blog.mozilla.org/services/2014/04/30/firefox-syncs-new-security-model/ https://blog.mozilla.org/services/2014/04/30/firefox-syncs-n... https://github.com/mozilla/fxa-auth-server/wiki/onepw-protocol https://github.com/mozilla/fxa-auth-server/wiki/onepw-protoc...

zokier 8y ago

If you have master password set in the browser then the password db is encrypted locally. I remember there being some noise about it not being very secure encryption, so better check the details if that is critical for you. As for the Firefox Accounts/Sync stuff, afaik MozCo servers see only encrypted content. https://medium.com/mozilla-tech/how-firefox-sync-keeps-your-secrets-if-tls-fails-14420d45885c https://medium.com/mozilla-tech/how-firefox-sync-keeps-your-... might provide more insight

woodrowbarlow 8y ago

as others have said, it's encrypted if you enable the "master password" option; however, the ux of the master password is miserable: * the prompt for entering your master password is a simple dialog, with "ok" and "cancel" buttons. a website could probably trigger an identical prompt with javascript to phish your master password. * the prompt pops up once when you first start the browser (about 15-30 seconds after everything is loaded) and then (if you dismiss it with "cancel") again each time you visit a site for which you have a saved password. there's no way to trigger the unlock prompt on-demand. * the master password doesn't have a timeout. once you've unlocked the keychain, it remains unlocked until you restart the browser. don't bother. stick with whatever third-party extension you're using.