4 ms·

If memory serves me Firefox cookies are stored unencrypted in an sqlite database with user level permissions. Haven't dug too deep, so I could be missing someth

If memory serves me Firefox cookies are stored unencrypted in an sqlite database with user level permissions. Haven't dug too deep, so I could be missing something, but last time I peaked down the rabbit hole that's what I remember.

snacktaster 8y ago
correct $ find "$HOME/Library/Application Support/Firefox/Profiles" -name cookies.sqlite -exec sh -c "sqlite3 '{}' 'SELECT * FROM moz_cookies'" \;
kuroguro 8y ago
Chrome stores them in sqlite as well. AFAIK on windows if running as the same user you just need to call CryptUnprotectData. No password needed. http://raidersec.blogspot.com/2013/06/how-browsers-store-your-passwords-and.html#chrome http://raidersec.blogspot.com/2013/06/how-browsers-store-you...
- garrettr_ 8y ago
  Windows’ OS keychain API is pretty weak, accessing secrets does not require user authorization. macOS and some Linux desktops environments do it slightly better, but there’s only so much you can do to defend against an attacker with the same privileges as the user.
gcb0 8y ago
unencrypted if you want to. firefox always allowed a password so it is encrypted at rest. you will have to pry it out of the process memory after the user type the password.
- tokyodude 8y ago
  Why can't any code that want's to steal your passwords in firefox's DB just use firefox's open source code to decrypt? Firefox requires no password to start up and access your passwords so why couldn't any other code just follow the same process?
  - gcb0 8y ago
    True. They suggest you use a master password, which solves this problem. But if you ignore that it will generate one for you which will only make it a little bit more annoying for anyone trying to steal directly from the offline file.
Ayesh 8y ago
There is a master password to encryption password storage, cookies, history, etc. They are encrypted at rest, and encrypted before sync.

snacktaster 8y ago

correct $ find "$HOME/Library/Application Support/Firefox/Profiles" -name cookies.sqlite -exec sh -c "sqlite3 '{}' 'SELECT * FROM moz_cookies'" \;

kuroguro 8y ago

Chrome stores them in sqlite as well. AFAIK on windows if running as the same user you just need to call CryptUnprotectData. No password needed. http://raidersec.blogspot.com/2013/06/how-browsers-store-your-passwords-and.html#chrome http://raidersec.blogspot.com/2013/06/how-browsers-store-you...

garrettr_ 8y ago
Windows’ OS keychain API is pretty weak, accessing secrets does not require user authorization. macOS and some Linux desktops environments do it slightly better, but there’s only so much you can do to defend against an attacker with the same privileges as the user.

gcb0 8y ago

unencrypted if you want to. firefox always allowed a password so it is encrypted at rest. you will have to pry it out of the process memory after the user type the password.

tokyodude 8y ago
Why can't any code that want's to steal your passwords in firefox's DB just use firefox's open source code to decrypt? Firefox requires no password to start up and access your passwords so why couldn't any other code just follow the same process?
- gcb0 8y ago
  True. They suggest you use a master password, which solves this problem. But if you ignore that it will generate one for you which will only make it a little bit more annoying for anyone trying to steal directly from the offline file.

Ayesh 8y ago

There is a master password to encryption password storage, cookies, history, etc. They are encrypted at rest, and encrypted before sync.