Firefox certificate store one password for all, for whole session, is insecure, not granular enough
Categories
(NSS :: Libraries, defect)
Tracking
(Not tracked)
People
(Reporter: libove, Unassigned)
References
Details
User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36
Steps to reproduce:
Store one or more certificates in Firefox -> Options -> Privacy & Security -> Certificates. Set a Firefox master password.
Visit any site at which you might use any one of those certificates.
Unlock the use by entering the one master password.
Go to any other site at which you might use any certificate.
There is no need to re-enter the master password, nor is there any kind of security at all.
Actual results:
See steps to reproduce
Expected results:
Every certificate must have an optional private key password, and a setting for how often to (re-)prompt for that certificate's password - just like the Windows 10 built-in Certificate store works.
One key (Firefox master password) to rule them all (all certificates, no matter at what site you might visit for the duration of a session) is inadequately granular security.
See also the Thunderbird thread https://bugzilla.mozilla.org/show_bug.cgi?id=838272
|
||
Comment 1•6 years ago
|
||
Bugbug thinks this bug should belong to this component, but please revert this change in case of error.
|
||
Updated•6 years ago
|
|
Reporter | |
Comment 2•6 years ago
|
||
Just for reference, this seems to be related to
https://bugzilla.mozilla.org/show_bug.cgi?id=838272
and
https://bugzilla.mozilla.org/show_bug.cgi?id=219842
It seems that Thunderbird and Firefox (please forgive me if my ignorance is showing here) both rely on this NSS component for certificate storage, and it is the NSS component that only has one password mode (none, or once-per-session which includes all certificates in the store).
The security concerns that I've stated above are valid for both Thunderbird and Firefox, though my focus is on Firefox as I don't personally use Thunderbird.
thank you.
|
||
Comment 3•6 years ago
|
||
As mentioned in the related bugs, supporting this for NSS-stored certificates is a significant undertaking. The direction for Firefox is to offload this functionality to the OS, which can leverage the more granular protections you mention. Given these factors, I'm resolving this as WONTFIX and would point you to osclientcerts (bug 1591269).
|
|
Reporter | |
Comment 4•6 years ago
|
||
Thank you Kevin. I'll follow up on the osclientcerts bug. I sincerely hope that the foundation does decide to address this soon. It's been outstanding for a long time, and I worry that it provides a real attack chain opportunity (infect a "known good" page where users SHOULD unlock their stored certificates, then redirect them somewhere else where they should NOT, but as the one-time-per-session unlock has already been performed, their certificates can then be [ab]used without a password prompt).
Description
•