Prompt profile Master Password at startup even if there no saved credentials
Hi there,
I know that many users have hated that Firefox asks for the master password from the beginning, but I would like to find an option for it to request it at the user's discretion.
I'm currently using both Firefox Developer Edition and Firefox ESR in portable versions stored on a USB drive for my work outside of the office or home.
The Developer Edition is synced with my Mozilla account and used on both Windows 10 and Linux systems. Conversely, Firefox ESR, which I use on Windows 7 devices, has synchronization disabled. As a result, with Sync turned off and no sensitive data stored in any Firefox installation, Firefox ESR doesn't prompt me for a master password.
Why do I want Firefox to ask for the master password right from the start, even without any sensitive data saved? It's quite simple: sometimes I'm surrounded by non-techy people and I'd like to give the 'impression' (when they see me using Firefox, because most use 'the other browser') that I'm 'protecting something'. It's also a way to 'intimidate' to some extent (if a password isn't entered, they'll think something won't work properly).
It may sound silly, but it's something that 'the other browser' doesn't offer locally.
Also (and I think it's logical), I find it ironic that having other sensitive data saved in Firefox, like enabled cookies, it doesn't ask for the master password, only when there are saved passwords or forms.
Alle Antworten (8)
Hi Gabe, I don't know whether you can expect a change like this in the near future. Many more people seem to be annoyed that Firefox requests credentials before they plan to use the Password Manager. I guess the solution is to have a preference for only unlocking on demand?
Mozilla has a product suggestion site at https://connect.mozilla.org/. If you have time, I think it would be a good idea to post this request there to get into the current feedback stream. Use the "Ideas" section of the site (at https://connect.mozilla.org/t5/ideas/idb-p/ideas).
In the short run, though, maybe there is an add-on to fake it?
jscher2000 - Support Volunteer said
Hi Gabe, I don't know whether you can expect a change like this in the near future. Many more people seem to be annoyed that Firefox requests credentials before they plan to use the Password Manager. I guess the solution is to have a preference for only unlocking on demand? Mozilla has a product suggestion site at https://connect.mozilla.org/. If you have time, I think it would be a good idea to post this request there to get into the current feedback stream. Use the "Ideas" section of the site (at https://connect.mozilla.org/t5/ideas/idb-p/ideas).
Hi @jscher2000. Thanks for replying.
Yes, that's exactly why I say that many people get annoyed by that (in fact, doing a search on the matter, people generally ask the opposite, how to make Firefox stop asking for the password).
Of course, in a situation using your own device, there are no problems, but when it comes to using Firefox on someone else's device (even with a portable version), it seems logical to me that it would ask for the password when starting Firefox.
In the short run, though, maybe there is an add-on to fake it?
An extension could also serve as a discreet solution, that is, that the extension saves a generic username/password entry in the user profile, which does not interact with anything. I imagine that this could also work today directly from the Firefox password manager, saving something random.
But I would like that configuration to exist through about:config
; I understand that it existed at some point but has been obsolete for a few versions.
If you use Sync then Firefox asks after a short delay for the Primary Password, since the credentials to login are stored in logins.json but are hidden from showing in the Password Manager (about:logins). Of course,like you probably know, this doesn't prevent accessing Firefox if you cancel this prompt.
Gabe Pérez said
... But I would like that configuration to exist through about:config
; I understand that it existed at some point but has been obsolete for a few versions.
I can't recall that ever existing as a built-in feature.
jscher2000 - Support Volunteer said
Gabe Pérez said
... But I would like that configuration to exist throughabout:config
; I understand that it existed at some point but has been obsolete for a few versions.I can't recall that ever existing as a built-in feature.
Correct me if I'm wrong, but I think it was this: security.ask_for_password
.
There should be a setting in Firefox similar to security.prompt_for_master_password_on_startup
, which Thunderbird currently has.
cor-el said
If you use Sync then Firefox asks after a short delay for the Primary Password, since the credentials to login are stored in logins.json but are hidden from showing in the Password Manager (about:logins). Of course,like you probably know, this doesn't prevent accessing Firefox if you cancel this prompt.
Hi, @cor-el
Yes, I understand that the master password doesn't lock down the entire profile, it only safeguards access to passwords and other private information. It doesn't prevent someone from using Firefox altogether. (I recall there was an extension a while back that could lock down Firefox with the master password, but it's no longer supported).
Gabe Pérez said
jscher2000 - Support Volunteer said
I can't recall that ever existing as a built-in feature.Correct me if I'm wrong, but I think it was this:
security.ask_for_password
.
The oldest source code I'm aware of was for Firefox 45 ESR. That preference exists, but there's no code that implemented it, so the preference had no effect:
https://searchfox.org/mozilla-esr45/search?q=ask_for_password&path=&case=false®exp=false
There was a bug report filed against Firefox 9 in 2012 that the preference had no effect there: https://bugzilla.mozilla.org/show_bug.cgi?id=719705
So it has been a while, if it ever functioned in Firefox (versus the Mozilla Suite, from whose code Firefox was developed).
I think that those security prefs were handled in NSS and not directly in Firefox.