Hacker News Reader

Comment by braxxox | Hacker News Reader

If memory serves me Firefox cookies are stored unencrypted in an sqlite database with user level permissions. Haven't dug too deep, so I could be missing something, but last time I peaked down the rabbit hole that's what I remember.

View on HN

Chrome stores them in sqlite as well. AFAIK on windows if running as the same user you just need to call CryptUnprotectData. No password needed.

http://raidersec.blogspot.com/2013/06/how-browsers-store-you...

Windows’ OS keychain API is pretty weak, accessing secrets does not require user authorization. macOS and some Linux desktops environments do it slightly better, but there’s only so much you can do to defend against an attacker with the same privileges as the user.

correct

    $ find "$HOME/Library/Application Support/Firefox/Profiles" -name cookies.sqlite -exec sh -c "sqlite3 '{}' 'SELECT * FROM moz_cookies'" \;

There is a master password to encryption password storage, cookies, history, etc.

They are encrypted at rest, and encrypted before sync.

unencrypted if you want to. firefox always allowed a password so it is encrypted at rest. you will have to pry it out of the process memory after the user type the password.

Why can't any code that want's to steal your passwords in firefox's DB just use firefox's open source code to decrypt? Firefox requires no password to start up and access your passwords so why couldn't any other code just follow the same process?

True. They suggest you use a master password, which solves this problem. But if you ignore that it will generate one for you which will only make it a little bit more annoying for anyone trying to steal directly from the offline file.

Reply on news.ycombinator.com