11

I have set up a master password on firefox and the browser asks for it at unexpected time. Not every time in the start (so it isn't useful to "lock" the browser. Someone may auto-login to a website without typing the master password), just at "random" time.

I don't really care about "locking" my browser, I just want to protect my set of passwords from unauthorised view. How can I make firefox ask for the master password ONLY when trying to show passwords?

Changing security.password_lifetime to a large value didn't work as a semi-solution, because it will ask again at random time if I restart firefox. I would also like to avoid using a separate password manager software.

  • 4
    Note that even if you achieve this, it may not provide the level of protection you're looking for. One way to view a saved password is to right-click in the text area where the saved password is automatically entered but obfuscated, click Inspect Element, and change the type="password" attribute to type="". The password is then displayed. – Eliah Kagan Apr 30 '15 at 9:02
  • 3
    This kind of change requires core code changes in core functionality. I highly doubt you'll find a solution to implement this via Ask Ubuntu. – Thomas Ward Apr 30 '15 at 11:41
  • 1
    If this is something that can be done, I would look in about:config searching privacy, preferences, or something like that. – j0h Apr 30 '15 at 22:08
4

Finally I found a good workaround on this, using the Master Password+ Firefox Add-on.

This add-on provides several options, one of them being "Block master password prompts". In case the master password is required, the Master Password+ icon blinks, but no pop-up is shown.

Note that the websites in which I am already logged-in continue working normally. If I explicitly try to use a saved password, then I have to click the Master Password+ to enter my master password and continue.

| improve this answer | |
3
+50

If you have a master password, then Firefox will need you to input that password in order to use any of your stored passwords. There is no way around this, because the stored passwords are actually encrypted using a key derived from the master password.

So it is not possible to have a master password, but set Firefox only to ask for it if you want to "view" the stored passwords. It will still need to ask for it when you want to "use" them, too.

When you describe it happening at "random" times, it is probably happening when you first visit a website for which you have a stored password. If you are logging in to some websites without it asking for your master password, it will be because that website has made your login persistent (eg using cookies) negating the need to show a login form on that website. Or it will be because the browser has already asked you for your master password recently, so it has no need to ask again.

What you can do is ensure that it will only ask you for the master password once per browser session, which is controlled by the config setting security.ask_for_password as mentioned elsewhere (set it to 0).

Or, you can disable the master password. Your passwords will still not be shown visibly by default when you are using them, only when you go in and view them in the password manager. There is nothing wrong with finding the right balance between security and convenience for you - if you are annoyed by needing to put in your master password too much, and don't mind if Firefox can use your saved passwords without it, then a master password is not for you. Unfortunately it won't then be able to make the passwords invisible to users of your browser, though.

| improve this answer | |
  • 1
    Thanks for all the answers. As all of them are like "this can't be done", I will not mark this as answered, so maybe someone in the future finds another way, maybe in a future version. Of course I awarded the bounty. :-) – MakisH May 7 '15 at 11:00
  • 3
    It is literally impossible to encrypt all your saved passwords with a master password, but allow Firefox to use these saved passwords on websites without prompting you for your master password. In order to do something like that, the browser could have taken for example Google Chrome's approach: use a key known to Google to encrypt your passwords, so Google Chrome can decrypt them any time without needing to ask you. This doesn't really achieve the level of security that Firefox's master password does. – thomasrutter Jul 12 '16 at 0:33
3

"security. ask_for_password" Determines when Mozilla should ask for the master password.

0 (default): Only the first time it's needed.(As per your need set this value)

1: Every time it's needed

2: Every n minutes, where n is the value in security.password_lifetime.

My personal suggestion. Before leaving the system to some one. Press ctrl+shift+deleteand clear everything. So that it will prompt for master password again.

Or

Set browser.privatebrowsing.autostart value to TRUE

Find here the Source

| improve this answer | |
1

"How can I make firefox ask for the master password ONLY when trying to show passwords?"

Uncheck the box "Ask to save logins and passwords for web sites" in Firefox settings, while leaving the box "Use a master password" checked.

See https://superuser.com/questions/1233346/using-master-password-without-prompt-popup-in-firefox/1441086#1441086

| improve this answer | |
1

On my (Kubuntu) system, having Firefox automatically sync with my other devices--an option in preferences--caused the "Password Required" pop-up to pop whenever Firefox was started. Not using Sync allows me to retain my Master Password without having to respond to the pop-up on every start.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.