Firefox Master Password System Has Been Poorly Secured for the Past 9 Years

https://www.bleepingcomputer.com/news/security/firefox-master-password-system-has-been-poorly-secured-for-the-past-9-years/

by ekianjo • 8 years ago

101 71 8 years ago

bleepingcomputer.com

lucb1e3• 8 years ago

This sounded like clickbait when reading the first bit (SHA1+iterations isn't that bad, as the SHA1 vuln doesn't affect password hashing), but it turns out the number of iterations is 1. That's not SHA1 "with a low iteration count", that's just plain SHA1. And no salt it seems.

Pretty bad indeed, but then again: this is a master password you're setting. The one password to rule them all ought to be strong anyway. If you do that, it's perfectly safe.

dzek692• 8 years ago

The one password to rule them all ought to be pretty strong anyway.

The problem is that each year definition of "strong password" changes, because of growing performance of CPUs and GPUs.

"Use a password manager" is always a good solution, I know. But well, who will remember the super lengthy password for the password manager? ;)

victor_vhv• 8 years ago

You can always use XKCD's password methodology ;)

https://xkcd.com/936/

adrianN• 8 years ago

I don't think the definition of "strong password" has changed much in the last ten years. The hashing schemes for storing passwords have changed, sure, but I think having sixteen or more characters with numbers, capital letters and symbols has been recommended for years now.

Perseids• 8 years ago

Passwords with 128bit of entropy have always been and will for the foreseeable future be secure with any password hashing algorithm that is not completely broken (i.e. uses a cryptographic hash function and a seed). 28 random alphanumeric characters fulfill the requirement and are reasonably fast to type, e.g. m7wdgdorhvi3jerzyztc2u642at

lucb1e3• 8 years ago

The problem is that each year definition of "strong password" changes

Luckily, you can change your password.

Also, you could say the same thing for the hashing algorithm. Every year you'd want to up your iteration count or even upgrade algos (e.g. use memory-hardness when scrypt was released).

It works both ways, but overestimating is never a bad idea: if someone hacks you now and cracks it in five years, some passwords may still be in use.

pafje• 8 years ago

From the article, the password is salted at least:

"I eventually found the sftkdb_passwordToKey() function that converts a [website] password into an encryption key by means of applying SHA-1 hashing to a string consisting of a random salt and your actual master password."

dzek692• 8 years ago

That's nothing new. At least Thunderbird is full of annoying even 10 years old bugs. Some important, some just annoying. I bet there's many more hidden because of security.

blattimwind• 8 years ago

This code is actually part of NSS, I wonder whether this affects other applications using the soft token db in a similar capacity.

https://dxr.mozilla.org/mozilla-central/source/security/nss/...

It also processes salt||pw; while that's not a problem per se for password hashing, I generally prefer unique encodings when hashing multiple fields, such as len(salt)||salt||len(pw)||pw.

tatersolid• 8 years ago

If there are only two fields, and the length of one is fixed (the salt) then the encoding is unique.

SHA1 (and other cryptographic hash functions) generally already include the length as something that is part of the hash itself, so your “length encoding” is completely redundant in the case of hashing salt|password.

Yoric• 8 years ago

Not sure, but I seem to remember that NSS is also used by Chrome.

robin_reala• 8 years ago

Not any more: they went to their own fork of OpenSSL called BoringSSL.

zaarn6• 8 years ago

While I would generally agree that the master password in Firefox is rather... non-ideal, to use a friendly term, I think the article is blowing it a bit.

Most users that I know use the master password system in combination with a very long master password. That should protect against some brute-forcing but everyone should at best not use the master password at all.

I think Mozilla might be better off by removing the internal password manager entirely and instead providing an interface for password managers (and ship a simple one with firefox that doesn't have a password protection, users can then pick a proper password manager on their own)

mcintyre1994• 8 years ago

Don't most users just stick with the default though? The shipped password manager going from one with a master password to one without would just mean most users have less security.

zaarn6• 8 years ago

Most users don't use the master password at all so most users will have the same security.

Users with master password will have to be informed they need to find a new solution.

raverbashing• 8 years ago

Funny how the solution is always "a new system that's coming very soon"

Instead, they could just have added a for loop

Antwan• 8 years ago

Dixit the biggest blackmailer of the Internet (cf acceptable ads).

epanchin• 8 years ago

I don’t think it’s an unreasonable guess than most people who use a master password in Firefox do so to prevent family/friends sharing their PC from easily discovering their passwords.

I can’t imagine them being too concerned with brute force attacks.

mattcoles2• 8 years ago

Since Firefox is open source, instead of just waiting for Mozilla engineers to get around to it, couldn't someone just open a pull request?

s_gourichon4• 8 years ago

Sure. Could you just write a patch implementing the solution? I'll then open a pull request submitting your patch, to save you some work. ;-)

In practice, this only works if you provide the password manager that will be chosen once and for all.

zaarn's suggestion "providing an interface for password managers" is an interesting alternative.

mattcoles2• 8 years ago

Haha, it was just the attitude I'm seeing suggests that we're somehow at the behest of Mozilla engineers and we just have to wait, but that's one of the great benefits of open source, we really aren't.

And I haven't looked but I imagine changing the encryption algo isn't a huge task, I wasn't suggesting that a non-Mozilla worker implement something huge like zaarn's suggestion, which fwiw I think is awesome as I don't use FF built-in password manager and find it just gets in the way.

jcranmer2• 8 years ago

Master passwords have a very narrow threat model that they are actually protecting against: it's protecting against people who have access to the password database (i.e., filesystem access) but not people who have access to ptrace-privileges (i.e., the ability to read the password directly out of process memory). Which pretty much means the only realistic use case is someone stole your laptop, but full-disk encryption is a much more relevant solution.

Mozilla has known for a very long time that the master password system isn't very effective. Even a decade ago, I remember them recommending not using it.

QasimK• 8 years ago

Can I clarify the distinction between the two capabilities? Are you saying that if I download and execute e.g. “fake-meme-creator” which turns out to be malware for whatever reason, then it can read the filesystem as any normal process can, but it cannot access ptrace?

If this is the case, I’d consider it to be useful because in general I don’t trust apps as a rule.

jcranmer2• 8 years ago

The way most systems are configured, your fake-meme-creator could access ptrace and the filesystem.

vbezhenar3• 8 years ago

That's why my passwords in text file and I consider it fine. If someone breaks into my machine and I won't notice it, password will be keylogged anyway. The only true defense would be hardware-protected external password storage, but I'm not aware of any.

paulryanrogers• 8 years ago

Yubikey

pasta• 8 years ago

People looking over your shoulders, you sending a screenshot where you forgot the open file in the background.

I agree a text file is 'secure' enough for you but a lot of password systems also hide the password in the UI which is a pro inho (I use KeePass).

magnat• 8 years ago

Which pretty much means the only realistic use case is someone stole your laptop

There is also case of "someone stole your backup", which is also quote realistic, especially when using third-party storage services.

signal11• 8 years ago

The “narrow threat model” actually applies to a very common social scenario where people share computers. For instance a family member might want to play Steam games, or print, or simply browse the web. Most people are not going to create a guest account for that. There passwords are then at risk if not adequately protected.

Even in work contexts, “hey can I use your computer to print something? Mine is frozen” is very common.

There was a similar discussion on the chromium tracker when they started storing passwords. I believe Chrome now use OS services (DPAPI on Windows and Keychain on MacOS) to protect passwords.

gruez• 8 years ago

workstation access + admin user[1] = game over from a security point of view.

at that point they can install a rootkit and bypass all your fancy DPAPI/keychain protections.

[1] before you say "but I got password on my sudo!", there's nothing preventing someone from aliasing sudo to

    sudo bash -c "/tmp/evil.sh; $*"

smacktoward• 8 years ago

Mozilla has known for a very long time that the master password system isn't very effective. Even a decade ago, I remember them recommending not using it.

A feature that users would be better off not using is a feature that should be removed, IMHO.

josefresco5• 8 years ago

Well to be fair, no other major browser even has a master password feature. I think the master password is good to stop "causal" hacking - by friends, family and/or un-tech savvy thieves.

ocdtrekkie• 8 years ago

Only the world's most popular browser also has it. https://www.ghacks.net/2013/12/04/google-chrome-gets-master-...

josefresco5• 8 years ago

Sort of...

The difference being that I can still "use" the passwords without this prompt (FF does not allow this) and I'm still able to view the entire PW database, which will show me usernames (but not passwords).

So, in fairness, Chrome has "sort of" implemented this feature (albeit in a laughable insecure way) and quite obviously have left it to rot (2013?!) on the digital vine.

mikeash3• 8 years ago

Safari does, by way of the OS Keychain.

josefresco5• 8 years ago

Must be a feature of MacOS - I don't see it within Safari for Win

kup0• 8 years ago

It's interesting how little attention this issue received throughout nine years of time, especially when you see a 5-year gap between updates/comments on the bug thread.

chengiz• 8 years ago

Well if you dont use a master password, the passwords are available with the Show passwords button. Firefox's saved passwords feature is not meant to protect against theft etc. (This is actually annoying to me, but I cant really flaw the model; people want what they want and the browser needs to provide it).

Finnucane• 8 years ago

I just _assumed_ that passwords stored in the browser would be vulnerable if someone got physical access to your computer. So never used that feature.

unhammer• 8 years ago

Huh, first time I've heard of Mozilla Lockbox ( https://www.bleepingcomputer.com/news/software/firefox-to-ge... / https://mozilla-lockbox.github.io/lockbox-extension/ ). That's great that they're working on a better alternative to the master password thing; the UI also needed some work (that annoying modal blocking the browser on every restart).

interfixus• 8 years ago

Thank heaven these days we have the KeePassXC browser plugin, finally obviating even the temptation to rely on flimsy internal browser storage.

UI- and convenience-wise, this is as good as LastPass used to be - and perhaps still is; I dropped them the day they were sold to some nefarious LockMeIn-entity.

sneak• 8 years ago

The same was true for GnuPG the last time I looked.

Firefox Master Password System Has Been Poorly Secured for the Past 9 Years

Related Stories