3 ms·

https://support.mozilla.org/en-US/kb/using-master-password-sync https://support.mozilla.org/en-US/kb/using-master-password-s... “When using Sync, your Firefox

https://support.mozilla.org/en-US/kb/using-master-password-sync https://support.mozilla.org/en-US/kb/using-master-password-s... “When using Sync, your Firefox Accounts login is stored with your saved passwords in the password manager. Your master password must be entered so Sync can access your Firefox Accounts login. Once the master password has been entered, Sync can also access your other saved passwords and sync them between your devices.” It looks like a master password has to be enabled separately, just having Firefox sync won’t encrypt passwords on disk from what this is saying.

NikkiA 8y ago
My point is that I found I could enter my firefox sync password and my master-pw-protected passwords were brought down from firefox without any trouble, ergo bypassing my master-pw completely. My expected behaviour would be that the master-pw would be used to encrypt the passwords, and this encryption would be carried to the sync'ed passwords such that knowing my sync password would be insufficient alone to get my cleartext passwords - which is, afaik, how almost all other (online/syncable) password managers work.