Passwords stored by Firefox, is it encrypted?

Question

I was rather surprised to find that I could read the passwords stored by Mozilla/Firefox (Preferences=>Security). I always assumed they were encrypted in some way.

Pure ignorance, I guess.

Comments

Check the box, "use master password" for "maximum" security. You'll then need to enter that to display passwords.

Answer 1

LOL. this is true.

On a serious side, moz does put out a decent try by storing passwords in file "signons.sqlite". which is not an encrypted file.

what file are you seeing your passwords in? see this link;

http://kb.mozillazine.org/Password_Manager

the diff of oos and linux versions is that access to the password manager is;

 Edit > Preferences > Security > [Saved Passwords...]

to open window Saved Passwords where you can edit password file.

to aide editing, i use;

https://addons.mozilla.org/en-US/firefox/addon/saved-password-editor/
https://addons.mozilla.org/en-US/firefox/addon/saved-passwords-button/

to export passwords, I use;

https://addons.mozilla.org/en-US/firefox/addon/password-exporter/

do you have above exporter and are seeing file it exports?

Answer 2

Obviously Firefox needs to save and recover all your passwords, if it were to automatically provide them on your behalf.

So the passwords must be accessible to Firefox. Merely not displaying them is a false sense of security.