Re:Master password in Firefox or Thunderbird? Do not bother
by e12e on Saturday March 10, 2018 @06:31PM
(#16560694)
This certainly is a usability issue with security implications. But it's salted, so if can have 60-96 bits of entropy in your master password - that should be maintained - and a reasonable level of security maintained.
There's a reason the master password was removed for a while while rolling out the new synchronisation infrastructure; the assumption is that the data is protected by the key stored and generated locally - and that that key is protected by full disk encryption.
If you can read the key, it is assumed you already can read everything the key protects.
I do agree with the poster that this isn't always a great set of assumptions.
But still; one strong master passphrase generated through diceware or similar will allow you to use the password manager; and then you can use secure, high entropy "pass keys" for everything else (random passwords with ~128 bit entropy).
There's a reason the master password was removed for a while while rolling out the new synchronisation infrastructure; the assumption is that the data is protected by the key stored and generated locally - and that that key is protected by full disk encryption.
If you can read the key, it is assumed you already can read everything the key protects.
I do agree with the poster that this isn't always a great set of assumptions.
But still; one strong master passphrase generated through diceware or similar will allow you to use the password manager; and then you can use secure, high entropy "pass keys" for everything else (random passwords with ~128 bit entropy).