1425123 - Master Password is not synced

Status: RESOLVED WONTFIX

(Firefox :: Sync, defect)

Description

[[e-mail]]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0
Build ID: 20171206182557

Steps to reproduce:

Enabled a (very secure) Master Password on my FF, with Sync enabled.  Then signed in to another Firefox with my (medium secure) Sync password.


Actual results:

To my surprise, Firefox did not ask for my Master Password before filling passwords.  This defeats the purpose of the Master Password.


Expected results:

The Master Password should be used to encrypt the synced passwords, and be required to decrypt them, even if you reinstall Firefox.

Comment 1

[Mark Hammond [:markh] [:mhammond]]

The key used to encrypt everything on the sync servers is derived from your Sync password, not your master password. We don't want to force people to use the same master password on all of their devices as each device may have different security requirements. Given your Firefox Accounts password protects data that leaves your computer and your master password protects data that doesn't leave your computer, I recommend you use a strong password for your Firefox Accounts password as well.