Master password in Firefox or Thunderbird? Do not bother
1–10 of 94 posts
Re: Master password in Firefox or Thunderbird? Do not bother
#2Fixing issues like this is clearly less important than implementing browser-side VR support, I don't see what Palant is on about. As a Firefox user, trading the security of any and all accounts I store passwords for in the browser is something I'd gladly exchange for ... anyway, VR is cool, right?
Guess I should dump the password store and go all-in on the 1Password extension.
Re: Master password in Firefox or Thunderbird? Do not bother
#3I don't understand why firefox doesn't use the underlying OS keyring like Chromium does. I can sort of understand why it currently doesn't (legacy code)... but why the lockbox extension instead of proper OS support? The more places your password is stored the greater the chance of one of them leaking them.
Re: Master password in Firefox or Thunderbird? Do not bother
#4Fixing issues like this is clearly less important than implementing browser-side VR support, I don't see what Palant is on about. As a Firefox user, trading the security of any and all accounts I store passwords for in the browser is something I'd gladly exchange for ... anyway, VR is cool, right? Guess I should dump the password store and go all-in on the 1Password extension.
What attack vector would be mitigated by switching to a stronger hashing scheme for this specific use case? And are there other mitigations that exist for this attack vector that would be more appropriate?
To me is seems that this feature of browsers is really only meant as a protection against non-advanced attackers accessing an unlocked computer. For this scenario, having a stronger hash would do nothing.
Having a stronger hash would mitigate against exfiltration off the device by malware, but if malware can exfiltrate files off your device it's very likely they can e.g. read your passwords from memory, or keylog until the next time you input the password. It would also mitigate against someone being able to dump your password db off your filesystem if they get physical access to your computer, but full disk encryption does that better, and also protects all the rest of your personal data that's stored on the device.
Historically this is why Chrom{e,ium} has been resisting introducing this feature. Its uses are very limited against "real" attackers.
Mozilla spending time on cool tech rather than dumb migrations between password schemes that provide no value seems like a good tradeoff.
Re: Master password in Firefox or Thunderbird? Do not bother
#5Fixing issues like this is clearly less important than implementing browser-side VR support, I don't see what Palant is on about. As a Firefox user, trading the security of any and all accounts I store passwords for in the browser is something I'd gladly exchange for ... anyway, VR is cool, right? Guess I should dump the password store and go all-in on the 1Password extension.
As someone who has been through probably every popular password manager at this point, make sure to decide what you might need in the future.
Honestly, it really boils down to "Do you want to use Linux and not have a half broken client running in Wine".
Either way, 1Password is nice :) I use KeepassXC myself which I can recommend.
Re: Master password in Firefox or Thunderbird? Do not bother
#6I don't understand why firefox doesn't use the underlying OS keyring like Chromium does. I can sort of understand why it currently doesn't (legacy code)... but why the lockbox extension instead of proper OS support? The more places your password is stored the greater the chance of one of them leaking them.
As I understand it, using the OS keyring makes it impossible to do synchronization of the passwords (e.g., between mobile device and desktop).
Re: Master password in Firefox or Thunderbird? Do not bother
#7I don't understand why firefox doesn't use the underlying OS keyring like Chromium does. I can sort of understand why it currently doesn't (legacy code)... but why the lockbox extension instead of proper OS support? The more places your password is stored the greater the chance of one of them leaking them.
As I understand it, using the OS keyring makes it impossible to do synchronization of the passwords (e.g., between mobile device and desktop).
This can't be the explanation, since Chrome manages to sync passwords between devices.
Re: Master password in Firefox or Thunderbird? Do not bother
#8Fixing issues like this is clearly less important than implementing browser-side VR support, I don't see what Palant is on about. As a Firefox user, trading the security of any and all accounts I store passwords for in the browser is something I'd gladly exchange for ... anyway, VR is cool, right? Guess I should dump the password store and go all-in on the 1Password extension.
[deleted]
Re: Master password in Firefox or Thunderbird? Do not bother
#9Fixing issues like this is clearly less important than implementing browser-side VR support, I don't see what Palant is on about. As a Firefox user, trading the security of any and all accounts I store passwords for in the browser is something I'd gladly exchange for ... anyway, VR is cool, right? Guess I should dump the password store and go all-in on the 1Password extension.
What attack vector would be mitigated by switching to a stronger hashing scheme for this specific use case? And are there other mitigations that exist for this attack vector that would be more appropriate? To me is seems that this feature of browsers is really only meant as a protection against non-advanced attackers accessing an unlocked computer. For this scenario, having a stronger hash would do nothing. Having a…
A lot of people have problems modeling threats. For example, in the article:
> Anybody who ever designed a login function on a website will likely see the red flag here
A login function on a website and a master password for your local system have very different threat models. Applying one to the other is a helpful heuristic but ultimately leads you in the wrong direction.
If we ask 'who is the attacker in the situation' the answer for both is very different.
The attacker we worry about in web logins is generally remote. The attacks we are primarily concerned with are:
a) They can dump hashes, often through SQL injection
b) They can attempt to bruteforce passwords remotely
With a local attacker for a local password db we have to assume that the attacker is executing locally on the system. Our threat model generally does not include the ability to exfiltrate the db in an encrypted state - at least, that isn't where you start.
Threat modeling is critical to security - there are a billion things like this that Could Be Better but we use threat modeling to prioritize. At some point someone asked "who are we protecting against?" and the answer was "a very, very specific type of attacker that we do not see often". And so yes, they focused elsewhere.
edit: To be clear, I don't work for Mozilla and actually have no idea if my "at some point" comment is accurate! I'm just saying that's generally how it goes. It could easily be the case that this just slipped through the cracks or some such thing. I do not know Mozilla's internal threat model, I can only guess.
Re: Master password in Firefox or Thunderbird? Do not bother
#10Fixing issues like this is clearly less important than implementing browser-side VR support, I don't see what Palant is on about. As a Firefox user, trading the security of any and all accounts I store passwords for in the browser is something I'd gladly exchange for ... anyway, VR is cool, right? Guess I should dump the password store and go all-in on the 1Password extension.
As someone who has been through probably every popular password manager at this point, make sure to decide what you might need in the future. Honestly, it really boils down to "Do you want to use Linux and not have a half broken client running in Wine". Either way, 1Password is nice :) I use KeepassXC myself which I can recommend.
Should check on password-store. Uses gpg encryption and git for syncing. Can't recommend it enough!