638966 - Store the sync key in the system keychain and/or in the NSS keystore/certdb

Status: NEW

(Firefox :: Sync, enhancement, P3)

Description

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

The Sync key should be stored in the operating system keychain (when available) and/or in the NSS keystore/certdb instead of in password manager.  This was suggested by someone in the Sync team but I forgot who already. This would prevent the user's sync from being deleted when the password manager is cleared. (Presumably, they would still have to re-enter their sync username/password to use sync, right?) Potentially this would also be part of the work which would enable Sync to work even when Firefox is in FIPS mode.

The best place to store the password depends on many factors including: (a) whether the operating system exposes a keychain API accessible to Firefox/Sync, (b) whether the user is (securely) authenticated by the operating system, (c) whether the user uses multiple profiles and/or multiple OS accounts when computers are shared by multiple users, and/or (d) whether the user has a master password set on his Firefox profile.

Comment 1

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

See also bug 496660.

Comment 2

[Chris Karlof [:ckarlof]]

It's worth considering this at some point given the amount of interference we're seeing with third-party password managers.

Comment 3

[Ryan Kelly [:rfkelly]]

We could consider taking a fresh look at this when we come to integrate the Logins storage rust component, since that'll be making some changes to the current location at which the key is stored.