4 ms·
> For instance, I already use a master password to encrypt/decrypt the password database in Firefox. This feature uses SHA-1. [1] > Why not allow the master p
by Fnoord 8y ago
> For instance, I already use a master password to encrypt/decrypt the password database in Firefox.
This feature uses SHA-1. [1]
> Why not allow the master password to also protect the settings and store them encrypted so a third party can’t modify them?
It cannot protect against such. It can protect against a household adversary such as a 4 year old, and that's about it.
[1] https://palant.de/2018/03/10/master-password-in-firefox-or-thunderbird-do-not-bother/ https://palant.de/2018/03/10/master-password-in-firefox-or-t...
- javagram 8y agoThat’s disappointing to see. I had assumed it used PBKDF or something sane. Of course if Mozilla had wanted to secure the config settings they could just fix the master password hashing functionality at the same time.