4 ms·
The headline appears to be misleading. If you use Firefox, the Master Password for the Software Security Device that must be entered on each restart of Firefox
by javagram 8y ago
The headline appears to be misleading.
If you use Firefox, the Master Password for the Software Security Device that must be entered on each restart of Firefox is certainly used to encrypt the passwords.
I believe the steps outlined in the article for Chrome are accurate but the word “Firefox” appears only in the headline.
- NikkiA 8y agoIt doesn't seem to be used if you use the firefox sync feature though, from my experiments, at least, I could sync my account and then open the passwords without the master password. That was about when I stopped using 'save password' and also disabled password syncing.
- javagram 8y agohttps://support.mozilla.org/en-US/kb/using-master-password-sync https://support.mozilla.org/en-US/kb/using-master-password-s... “When using Sync, your Firefox Accounts login is stored with your saved passwords in the password manager. Your master password must be entered so Sync can access your Firefox Accounts login. Once the master password has been entered, Sync can also access your other saved passwords and sync them between your devices.” It looks like a master password has to be enabled separately, just having Firefox sync won’t encrypt passwords on disk from what this is saying.
- NikkiA 8y agoMy point is that I found I could enter my firefox sync password and my master-pw-protected passwords were brought down from firefox without any trouble, ergo bypassing my master-pw completely. My expected behaviour would be that the master-pw would be used to encrypt the passwords, and this encryption would be carried to the sync'ed passwords such that knowing my sync password would be insufficient alone to get my cleartext passwords - which is, afaik, how almost all other (online/syncable) password managers work.