The master password has been designed to protect the saved password listing from other users. It basically means that the password needs to be entered before the listing can be accessed for the first time protecting the user’s saved login information.

The master password needs to be entered only once during a Firefox session (that’s the time from opening the browser until it is closed again) which leads to further difficulties. Anyone can access the password list again once the master password has been supplied with no apparent option to lock the browser again other than to close it.

Master Password+ has been designed to improve the master password feature of the Firefox web browser and Thunderbird email client. It adds a set of features to the master password to make it more secure. Among the options is a timeout feature which can be set to reset the master password flag so that it needs to be entered again after a certain time. It is furthermore possible to lock and unlock the master password with the hotkey Alt-L.

The master password prompt can also be launched during browser start so that the profile can only be used if it is entered correctly by the user. Master Password+ improves the security if the master password is being used in Firefox. The master password itself on the other hand does not offer 100% protection. The add-on is available for Firefox 3 and 4 as well as the Thunderbird email client.

We reviewed FireMaster back in 2007. The principle to recover the Firefox master password has remained the same but the options to recover it have been improved. FireMaster is compatible with the latest version of the Firefox web browser. It uses brute force, dictionary attacks or a hybrid of both methods to recover the Firefox master password.

The command line tool requires the key3.db file which stores the master password information. The tool uses the following method to recover the password.

• FireMaster generates passwords on the fly through various methods.
• Then it computes the hash of the password using known algorithm.
• Next this password hash is used to decrypt the encrypted data for known plain text (i.e. “password-check”).
• Now if the decrypted string matches with the known plain text (i.e. “password-check”) then the generated password is the master password.

The success rate of the available methods depends largely on the Firefox master password. One interesting feature is the ability to specify known parts of the password in the command line argument.

FireMaster.exe -b -c "abyz" -l 12 -p "fire?????123" c:\testpath

This command above will perform a brute force crack using the character set abyz. The minimum password length has been set to 12 in this example and the password begins with fire and ends with 123. The path at the end points to the key3.db file that contains the master password information.

Firemaster is compatible with all official versions of Firefox and runs on Windows operating systems.