1. Yes but that doesn't answer the standalone question.

2. I do trust Mozilla to have the technical expertise to build a secure password manager. But just because they can do it, still doesn't answer why they're doing it the way they're doing it.

I would just like to hear Mozillas thought process that went into this. I'm sure they have reasons for all decisions, but I can't read thoughts.

Knowing their thought process would help me evaluate my prediction of this being abandon-ware in half a year.

> Browsers are expected to have password management of some sort. Firefox's existing one is rather inadequate from a UX and security standpoint, as recently discussed.

I'd like to see this discussion.

For me, I find Firefox's password manager the only one I can bother using, because it offers a good and seamless UX, right where I need it.

If they "fix" that by making it terrible like Lastpass, I honestly don't know what I'll do.

> I'd like to see this discussion.

Concerning the "security standpoint", probably this news [0] is meant. Hashing the password with SHA-1 using 1 iteration may be referred to as "inadequate".

[0] https://www.bleepingcomputer.com/news/security/firefox-maste...

Maybe if the hash were actually being stored, as in a website's accounts database, but SHA-1 is being used here to normalize a variable-length user-supplied password into a fixed-length string which can be used as the key input to an encryption function.

The article approaches this from an angle of an attacker with access to this hash bruteforcing it to obtain the original plaintext password. But as the hash is the encryption key, if an attacker were able to recover it from the encrypted password store blob, it would already be game over.

Applying a more costly hash algorithm would increase the cost of generating guessed encryption keys in a bruteforcing scenario, strengthening weak passwords somewhat. But using a single SHA-1 iteration here doesn't weaken the password security model. A strong password will remain strong.

> 1. Browsers are expected to have password management of some sort.

Having a browser component that can be asked by other browser components to pretty please fill in some secrets seems like a way to increase your attack surface. With an external password manager and no integration there's no internal API to be exploited, short of compromising the whole user, or if you have some sort of application isolation, the whole system.