1463865 - (oskeystore) [meta] Support OS-level secret-keeping

Status: NEW

(Core :: Security: PSM, enhancement, P3)

Description

[J.C. Jones [:jcj] (he/they)]

This meta-bug tracks designing and then implementing an interface for generating, storing, and retrieving secrets from the operating systems on which Firefox runs.

Comment 1

[Tom S. (please needinfo tschuster)]

What is the use case for this feature?

Comment 2

[Franziskus Kiefer [:franziskus]]

> What is the use case for this feature?

This is going to be used for passwords stored in Firefox to start with (and should be used for all sensitive data Firefox puts on the hard drive in future).

Comment 3

[Peter Saint-Andre [:stpeter]]

AIUI, the first project to use this feature will be web payments, in order to store credit card data more securely. I believe that password storage will happen after we deploy this feature for web payments.

Comment 4

[duparchy]

Hi,
This is more a "feature request" than a bug report, but I strongly plead in favor of moving from "Primary password" (that most people don't activate and don't even know it exists ) to a platform protection when available, transparently activated instead.

Our company will probably move from Firefox to another browser because of that...

Comment 5

[duparchy]

Hi, It seems that latest FF (and TB) supports now that feature, yes ?
"Require Device sign in to fill and manage passwords"

Comment 6

[Dana Keeler (she/her) [:keeler]]

(In reply to duparchy from comment #5)

Hi, It seems that latest FF (and TB) supports now that feature, yes ?
"Require Device sign in to fill and manage passwords"

No - that setting doesn't store secrets in OS-provided storage. It's more like "check if you're authorized to use this machine before accessing secrets stored by Firefox".

Comment 7

[duparchy]

If this prevents using someone's stored password by simply copying the profile, it's fine with me.

Comment 8

[Lazy Monkey]

so what happens if I make a backup of the profile, then reinstall the OS, and then recover the firefox profile?
will it still all work, including passwords?

Comment 9

[duparchy]

Reporting a problem with the current feature on a Windows 2022 RDSH server. (Users don't have admin rights.)

Error : The user has not been granted the requested logon type at this machine.

Event log :

Subject:
Security ID: yyyy\xxx
Account Name: xxx
Account Domain: yyyy
Logon ID: 0x13CE78BB

Logon Type: 2

Account For Which Logon Failed:
Security ID: NULL SID
Account Name: xxx
Account Domain: yyyy

Failure Information:
Failure Reason: The user has not been granted the requested logon type at this machine.
Status: 0xC000015B
Sub Status: 0x0

Process Information:
Caller Process ID: 0xbb10
Caller Process Name: C:\Program Files\Mozilla Firefox\firefox.exe

Comment 10

[Dana Keeler (she/her) [:keeler]]

Please file a new bug with as much information about how you encountered this error.

Comment 11

[Daniel Veditz [:dveditz]]

(In reply to Lazy Monkey from comment #8)

so what happens if I make a backup of the profile, then reinstall the OS, and then recover the firefox profile?
will it still all work, including passwords?

No, how could it? In any encryption scheme (that actually protects your data), if you lose the key then you've lost the data.

If you use Firefox Sync then that could function as a backup—as long as you haven't forgotten your Firefox Accounts password ("the key", effectively).

We are also working on a "profile backup" feature that could be used once it's done. That will create an encrypted bundle of your profile data using a password, which would then be portable to another machine or after an OS re-install.

Comment 12

[duparchy]

This seems to contradict Dana Keeler's response above : " No - that setting doesn't store secrets in OS-provided storage. It's more like "check if you're authorized to use this machine before accessing secrets stored by Firefox".

Comment 13

[Dana Keeler (she/her) [:keeler]]

(In reply to duparchy from comment #12)

This seems to contradict Dana Keeler's response above : " No - that setting doesn't store secrets in OS-provided storage. It's more like "check if you're authorized to use this machine before accessing secrets stored by Firefox".

That was specifically in response to your question in comment 5:

Hi, It seems that latest FF (and TB) supports now that feature, yes ?
"Require Device sign in to fill and manage passwords"

I was talking about how Firefox currently works, not how this bug wants Firefox to work.

Comment 14

[duparchy]

I changed my mind on this... A "Primary Password" offers more security than OS-level secret-keeping.
If the user password is compromised, the Primary Password is not.

Yet, some sort of default strong protection of saved passwords should be in place, be it a mandatory Primary Password or OS-level.