How to make firefox ask for master password only when trying to show passwords

Question

I have set up a master password on firefox and the browser asks for it at unexpected time. Not every time in the start (so it isn't useful to "lock" the browser. Someone may auto-login to a website without typing the master password), just at "random" time.

I don't really care about "locking" my browser, I just want to protect my set of passwords from unauthorised view. How can I make firefox ask for the master password ONLY when trying to show passwords?

Changing security.password_lifetime to a large value didn't work as a semi-solution, because it will ask again at random time if I restart firefox. I would also like to avoid using a separate password manager software.

Solution 1

Finally I found a good workaround on this, using the Master Password+ Firefox Add-on.

This add-on provides several options, one of them being "Block master password prompts". In case the master password is required, the Master Password+ icon blinks, but no pop-up is shown.

Note that the websites in which I am already logged-in continue working normally. If I explicitly try to use a saved password, then I have to click the Master Password+ to enter my master password and continue.

Solution 2

If you have a master password, then Firefox will need you to input that password in order to use any of your stored passwords. There is no way around this, because the stored passwords are actually encrypted using a key derived from the master password.

So it is not possible to have a master password, but set Firefox only to ask for it if you want to "view" the stored passwords. It will still need to ask for it when you want to "use" them, too.

When you describe it happening at "random" times, it is probably happening when you first visit a website for which you have a stored password. If you are logging in to some websites without it asking for your master password, it will be because that website has made your login persistent (eg using cookies) negating the need to show a login form on that website. Or it will be because the browser has already asked you for your master password recently, so it has no need to ask again.

What you can do is ensure that it will only ask you for the master password once per browser session, which is controlled by the config setting security.ask_for_password as mentioned elsewhere (set it to 0).

Or, you can disable the master password. Your passwords will still not be shown visibly by default when you are using them, only when you go in and view them in the password manager. There is nothing wrong with finding the right balance between security and convenience for you - if you are annoyed by needing to put in your master password too much, and don't mind if Firefox can use your saved passwords without it, then a master password is not for you. Unfortunately it won't then be able to make the passwords invisible to users of your browser, though.

Solution 3

"security. ask_for_password" Determines when Mozilla should ask for the master password.

0 (default): Only the first time it's needed.(As per your need set this value)

1: Every time it's needed

2: Every n minutes, where n is the value in security.password_lifetime.

My personal suggestion. Before leaving the system to some one. Press ctrl+shift+deleteand clear everything. So that it will prompt for master password again.

Or

Set browser.privatebrowsing.autostart value to TRUE

Find here the Source

Solution 4

"How can I make firefox ask for the master password ONLY when trying to show passwords?"

Uncheck the box "Ask to save logins and passwords for web sites" in Firefox settings, while leaving the box "Use a master password" checked.

See https://superuser.com/questions/1233346/using-master-password-without-prompt-popup-in-firefox/1441086#1441086

Solution 5

On my (Kubuntu) system, having Firefox automatically sync with my other devices--an option in preferences--caused the "Password Required" pop-up to pop whenever Firefox was started. Not using Sync allows me to retain my Master Password without having to respond to the pop-up on every start.

View more solutions

Comments

[Thomas Ward]

This kind of change requires core code changes in core functionality. I highly doubt you'll find a solution to implement this via Ask Ubuntu.

[j0h]

If this is something that can be done, I would look in about:config searching privacy, preferences, or something like that.

[MakisH]

Thanks for all the answers. As all of them are like "this can't be done", I will not mark this as answered, so maybe someone in the future finds another way, maybe in a future version. Of course I awarded the bounty. :-)

[thomasrutter]

It is literally impossible to encrypt all your saved passwords with a master password, but allow Firefox to use these saved passwords on websites without prompting you for your master password. In order to do something like that, the browser could have taken for example Google Chrome's approach: use a key known to Google to encrypt your passwords, so Google Chrome can decrypt them any time without needing to ask you. This doesn't really achieve the level of security that Firefox's master password does.

[gcb]

This is wrong. that setting is a left over from mozilla mail. It does absolutely nothing on firefox. see kb.mozillazine.org/About:config_entries#Security. >Determines when Mozilla Mail should ask for the master password

[JustAC0der]

the add-on no longer exists