Slashdot Mirror
Firefox Master Password System Has Been Poorly Secured for the Past 9 Years, Researcher Says (bleepingcomputer.com)
Catalin Cimpanu, writing for BleepingComputer: For at past nine years, Mozilla has been using an insufficiently strong encryption mechanism for the "master password" feature. Both Firefox and Thunderbird allow users to set up a "master password" through their settings panel. This master password plays the role of an encryption key that is used to encrypt each password string the user saves in his browser or email client. Experts have lauded the feature because up until that point browsers would store passwords locally in cleartext, leaving them vulnerable to malware or attackers with physical access to a victim's computer. But Wladimir Palant, the author of the AdBlock Plus extension, says the encryption scheme used by the master password feature is weak and can be easily brute-forced. "I looked into the source code," Palant says, "I eventually found the sftkdb_passwordToKey() function that converts a [website] password into an encryption key by means of applying SHA-1 hashing to a string consisting of a random salt and your actual master password."
See subject.
On Mac, the default Firefox behavior is now to use the system keychain (although that used to require an add-on). On Gnome (Linux) I believe you can do the same thing with Gnome’s keychain manager. And certainly tools like LastPass will integrate with the browser.
Don’t get me wrong - Firefox should fix this. But you don’t need to rely on their built-in password vault.
#DeleteChrome
So just to be clear.
You'd still need to brute force crack one the hard way, with no rainbow tables, or finding a hash collision, but once you find one, you know the master password for all.
Considering the security track record and huge attack surface of the modern web browser, you'd be certifiably insane to use one as a password manager.
Of course, bleepingcomputer says so, extremely poorly. Par for the course.
I blame msmash, who tries to be a hacker by writing stupid stuff on slashdot.
1) Using SHA-1 in this day and age; and
2) Using only one (guessing; cbf reading the article) hash round (compare to PBKDF2, which uses an arbitrarily-specifiable number, but usually over a few thousand, from memory)
Also: how long is the salt value?
Correct me if i'm wrong. But shouldn't a main stream browser like firefox be using something that actually could be considered even remotely secure for the mother password of all your other passwords? It sounds almost intentional, if not exceedingly negligent. And after nine years and it's now only coming to light? Something doesn't sound right.
Those who can, do. Those who cannot, sue.
The golden rule of technology: Just because you can do it doesn't mean you should. This means more today than ever.
Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
why I never save my passwords in any browser.
Browser password managers are AWFUL and were never any good.
So what? Yes, SHA-1 is a bit dated and is definitely not future-proof, but so far only second image type of attack has been shown for it (and it took immense amount of computational resources), and reversing is still not practically possible. Heck, even MD5 would be sort of OK for personal use (no one keeps, or, is ought to keep, top-secret passwords in browser anyway).
The fact that Firefox still uses SHA-1 just means that it's time (OK, it's time for 2—8 years already) to move to more secure hashes, nothing more.
More likely to be used by roommates, spouses and cohabitating couples than by Russian hackers.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Exponents protect secrets.
Factors are window dressing designed to make things look nice.
I personally think everyone should use amplification because it really does make guessing more difficult with no substantive downsides.
Yet at the same time to conclude failure to use amplification means "poorly secured" is comically wrong.
The fact operations are repeated thousands of times over always elicits those who bring up obvious point really takes x times more resources to obtain a result.
Yet it is not so clear what the relevance is. So what if it takes a day vs a few minutes or months vs few hours or the difference between doing it yourself vs farming the job out to thousands or millions of processors?
At the end of the day calculus is not significantly changed regardless of whether amplification is used or not.
1. Those with low entropy keys should be worried.
2. Those with high entropy keys are better off finding something else to worry about.
The more bits you add to the search space more worthless amplification schemes look in comparison.
the only thing encrypted is the password. What email accounts you have, user names, subjects, recipients and contacts you send to are all unencrypted and readable. Only the password is encrypted... It's ridiculously bad.
> using a master password in *any* browser
whew lad
SHA1 is not broken for this use. If the password is weak, you could brute-force it, sure. But then the user already has a problem. If the password is strong, then this is perfectly secure. Of course, using Argon 2 would be better, bit if the password is really weak, that can only do so much to make it more secure.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Ok - if someone has access to your machine, it's game over anyway. Brute forcing a password on a machine like this would require you to make your actions known to the user. Now, let's say you copied the stuff somewhere. It still takes time and effort. Bottom line, physical security is key. This is NOT an online attack vector. This is just some researcher reporting that the hashing is not secure and didn't bother to check the context for the problem. This is like saying that the hashing algorithm for local passwords is insecure because they can be brute forced. You're already at the physical system. Of course it can. That's why you use full disk encryption. Firefox local passwords being encrypted are a nice-to-have.
But Firefox isn't using SHA-1 as a password hash; it's being used to generate deterministic noise for generating an encryption key, at which point the hash is thrown away. So if you generate billions of hashes that won't help you because you don't have the original hash to compare against.
Until you find a situation where you at least know 1 password stored in a database (stolen through other channels - e.g.: one of the webserver database leaks mentionned regularily on haveibeenpwnd.com) or rely on password reuse (there's bound to be at lest 2x the same entry over the whole password data base).
At that point, the idea is to brute force the master password, until either two entries decrypts to the same content or until at one entry in the data base matches the 1 clear password you know.
Of course it's much slower (every single entry in the database uses a different salt, so you need to iterate over the whole database every single time for every iteration of the brute force attack), so it's definitely not the situation of "brute force a 6 characters password for 2 dollars on EC2", but it's still within the realm of possibilities.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
While SHA1 is dated, yes, it's still better than let's say Pidgin - which stores all passwords plaintext inside the account XML file.
I'm sure lots of people that use it have it connected with their google account as well. (Insecure accounts boo hiss enabled and all that guff)
You are correct, SSL is a PCI fail. As is TLS 1.0. TLS 1.1 is frowned upon but it won't make you fail PCI.
Real-time analysis of TLS traffic is okay. GP said it was LOGGED. That's probably a fail, because the logs probably aren't secured enough.
but I still figured I'd use a separate password manager just because I figured the FF one would be a bigger target.
Browsers are the front line application that is the first to be hit by any malicious software out there. That means it should be considered the LEAST secure, and treated accordingly.
Having a password manager is good, but it HAS to be kept external to the browser, so if the browser is compromised (or it does something moronic like autofilling fake login forms), then it can't compromise sensitive data along with it.
There are plenty of them out there, from 1Password to LastPass, it's just a matter of education and encouraging people to use these tools.
So I shouldn't let people have access to my computer?
“Common sense is not so common.” — Voltaire
To support the article title, the logically necessary claim is that it was easy to brute force nine years ago.
Not that I would expect a security researcher able to improve on SHA1 to be pedantic about these kinds of "minor" details.