When signing into Firefox Sync to set up a new computer, the primary password is not applied. I usually forget this, and it takes a couple of runs for me to remember to set it up.
That’s not enough for a post, so here are some additional things about it:
The primary password protects all passwords, but not other data. If someone can access Firefox data, bookmarks and history are effectively stored in the clear.
The primary password is intended to prevent reading credentials… and the Sync password is one of those credentials. That’s why a profile with both Sync and a primary password wants that password as soon as Firefox starts; it wants to check for new data.
The same limitation of protections applies to Thunderbird. If someone has access to the profile, they can read all historic/cached email, but they will not be able to connect and download newly received email without the primary password.
The Primary Password never times out. As such, it creates a “before/after first unlock” distinction. After first unlock, the password is in RAM somewhere, and the Passwords UI asking for it again is merely re-authentication. Firefox obviously has the password saved already, because it can fill form data.
Some time ago, the hash that turns the primary password into an actual encryption key has been strengthened somewhat. I believe it is now a 10,000-iteration thing, and not just one SHA-1 invocation. The problem with upgrading it further is that the crypto is always applied; ”no password” is effectively a blank password, and the encryption key still needs to be derived from it to access the storage. Mozilla understandably doesn’t want to introduce a noticeable startup delay for people who did not set a password.
Very recently (2024-10-17), the separate Firefox Sync authentication was upgraded. Users need to log into Firefox Sync with their password again in order to take advantage of the change.
No comments:
Post a Comment