@david_chisnall@infosec.exchange
Post #2094699
2026-05-06 11:45 UTC
@kaidenshi @KF0UNK
It's been ages since I looked at Firefox's password storage and that was before they moved to a multi-process architecture. Back then, a JavaScript sandbox escape could leak all passwords.
From a quick skim of their docs, they encrypt the passwords on disk. It looks as if protecting the key that they're encrypted with from an attacker with local filesystem access requires you to set a primary password (which is presumably hashed and fed to a KDF to generate the keys), but that key will be in memory for at least one process.
Replies (1)
-
@KF0UNK@mastodon.hams.social 2026-05-06 17:18
@david_chisnall @kaidenshi FWIW my opinion on this was from like a whole infosec podcast episode breaking down how insecure this is everywhere and the implications for the threat model. Always use MFA and favor external password managers for anything critical, but like I have MFA for things and don't sweat the plaintext (random single use) password for each account being in a browser session.