Firefox's password "security" is mind-numbingly stupid

Let me start with a deliberately simplified description of how Firefox protects your saved passwords.

It stores them in your Firefox profile, in plain text.

If someone gets read-only access to the right files in that profile, they can take your saved passwords with them. They don’t need to modify Firefox. They don’t need administrator access to the machine. They don’t need to exploit a memory-corruption bug. All they need is the entirely unprotected logins.json and key4.db.

This is obviously bad. Profile directories get copied into backups. Home directories get mounted into containers and virtual machines. Files end up in troubleshooting archives. People change filesystem permissions. Profiles get placed on networked filesystems. Developers copy profiles around while debugging things. We really don’t want these passwords stored in plain text.

At a glance, it may seem like there’s no good solution to this problem. Obviously you can have a master password used for encryption, but many users won’t want this, so how can we protect the file?

How Chrome does it #

Chrome has a pretty simple answer to this question: use the operating system’s secret storage. The exact mechanism depends on the platform and isn’t too important here. macOS has Keychain. Linux desktops have Secret Service and KWallet. Windows has its own credential-protection APIs.

The important part is simple: The OS gives you a key that is stored securely and can be used to encrypt the password store. If someone gets read access to your Chrome profile, they can not just read your passwords and cookies straight out of the file. All other major browsers use similar platform-backed mechanisms. It’s a pretty standard way to do things.

It is worth noting that this doesn’t make Chrome immune to malware. If an attacker can run arbitrary code then they can probably get at the passwords in the profile. However once you can run arbitrary code you can just replace the whole browser, install a keylogger, or do do a hundred other things to get at anything you want.

So now we’ve established that Firefox has poor security here and other browsers have a simple solution. While that does look bad, that doesn’t seem like enough to call it “mind-numbingly stupid”. I’ll explain why I’m calling it such now.

Firefox doesn’t actually store the passwords in plain text #

Firefox already encrypts your passwords! That’s what makes this so frustrating! Current Firefox encrypts the usernames and passwords stored in logins.json. They even recently upgraded the saved-login encryption from the old 3DES-based scheme to AES-256-CBC, so this isn’t old code that no one is willing to touch.

You’re probably now asking what the problem is. The encryption key is stored in a file right alongside the password database! They’ve bothered to implement all this cryptographic machinery, they’ve done 99% of the work to store passwords properly and then they’ve just throw it all away by storing the key in plain-text!

I believe this clearly qualifies as mind-numbingly stupid.

Mozilla has known about this for a very long time #

This isn’t just a case of nobody looking at the code before. Mozilla Bug 496660, titled “Store Master Password in Keychain,” was opened 17 years ago. The original proposal explicitly pointed out that, because most users probably did not configure a master password, their saved passwords could otherwise be exposed with little effort. It proposed generating a random password and storing it in the operating-system keychain. The discussion even mentioned equivalent Windows APIs.

The bug was eventually closed WONTFIX. The explanation was that “It’s generally agreed among UX/Engineering/Product that we don’t want to further develop the existing master password functionality, as it’s a poor fit for current needs and our current direction in this area.”

This is absolutely ridiculous. No explanation was given of why they’re ignoring blatant security holes. I guess they just doon’t feel like working on it. I guess whatever their “current needs and […] current direction” are must be more important than basic security.

Firefox’s cookies are worse #

While I’m ranting about Firefox security, let’s take a look at cookies too. In short, they’re even worse than passwords, they get no encryption at all. As most readers probably know, a cookie can be just as sensitive as a password as it can store a session secret that gives you exactly the same access to an account that a password would. Firefox has a 25-year-old bug (56788) titled “Cookies need to be encrypted when stored on disk.” The bug is still open to this day. I’m sure everything they’ve worked on in the last 25 years has been far more important than keeping cookies secure.

At least having a master password helps, right? #

Firefox does provide one way to improve the password store situation. You can configure a master password. When you do that, Firefox uses it to encrypt the database so reading the file isn’t enough to steal all your passwords. It doesn’t protect your cookies, but at least it’s something.

Aside from using weak cryptography, which has now been fixed to some degree, Firefox has spent a majority of its life knowing that the master password prompt can be spoofed by a web page. Bug 101611, entitled “Web sites can easily spoof the Primary Password dialog”, was opened 24 years ago. Firefox has gone through multiple generations of user-interface redesign in that time where they could have easily fixed this. I don’t know why they haven’t bothered, Firefox developers have been active in the thread, however Mozilla as a whole just doesn’t seem to care.

Firefox Sync and key rotation #

Let’s take a look at one more bug 1532594 next, entitled “Firefox Sync Design Flaw - Encrytion key doesn’t change when the user changes their password.”

The title sums this up pretty well and the security issue should be obvious. Everyone is told that changing your passwords is the first think you should do after a phishing attack or similar, obviously not rotating keys when the password is changes makes this advice pretty useless. Mozilla confirmed that this was correct and said “the current design is deliberate.” Once again they just don’t seem to take security seriously.

There’s probably other glaring security issues that I haven’t heard about before. Based on just the few I have seen, I have no faith in Mozilla to make good decisions when it comes to security. I don’t know what would convince Mozilla to start caring, however clearly something needs to be done.