Firefox Passwords can't be synced if you use a master password
Mozilla launched the new Firefox Sync feature in Firefox 29 to improve the usability of the process. It requires that you create a Firefox account which is used for authentication.
The creation of the account requires verification of the email address which Mozilla has been criticized for by some users of the browser.
Firefox Sync enables Firefox users to synchronize browsing data between devices. The synchronization process supports tabs, bookmarks, passwords, the browsing history, add-ons and preferences currently.
If you have set up the new synchronization feature on a device you may have noticed that passwords are not included in the synchronization process even though Sync supports that.
The reason here is that passwords won't be synced if a master password is set on the target machine. Mozilla's suggestion is to remove the password password. While that is an option, it is not really the best option considering that the passwords won't be protected anymore by the master password on local machines.
The master password needs to be entered once per browsing session to unlock the passwords stored in Firefox's database.
Do the following to disable the master password in Firefox:
- Tap on the Alt-key and select Tools > Options from the menu bar that opens up.
- Switch to the Security tab in the options window and uncheck "use a master password" on the page that opens.
- You need to enter the master password to complete the process.
Mozilla is working on a solution apparently to make Firefox Sync compatible with master password set. Unfortunately, no data was given when this is going to be corrected.
According to some replies on the linked Bugzilla page above, the reason why the new Firefox Sync cannot access passwords protected by a Master Password is that it can't access the encrypted passwords at all before the passwords are decrypted by the master password. Since Mozilla could not fix the issue in time for Firefox 29, it decided to disable password syncing if a master password is set instead.
Options
So what are your options right now if you want to sync passwords?
- You can use the old Firefox Sync for now, but Mozilla will turn it off eventually in the coming months. While it may work right now, it is not a future-proof solution.
- You can use a password manager such as LastPass which is available for Firefox on the desktop and Android to sync your passwords. As an added benefit, it is also available for other browsers.
- Do nothing and hope that Mozilla will fix the issue soon.
love FF but this was a total bonehead decision. I’m downgrading to 28 and waiting for a fix
Anyone (with any sense) should surely be using a master password if they use Firefox to store usernames and passwords? Otherwise anyone can walk up to your browser and view all passwords etc with a few clicks – even though this may not worry you it surely should with a laptop – which can always be lost or stolen.
To have released FF29 with the essential master password synch disabled was a stupid decision IMO. They just couldn’t contain their excitement at the new user interface and had to release it before it was ready! I have moved to the PaleMoon browser, a fork of FF24, which doesn’t have the disadvantage of the UI changing every five minutes as they excitedly follow the latest fashion.
Dropping security ‘for a while’ is not an option in my book for sensible software development.
Thanks a whole bunch for posting the bugzilla link. I’ll keep my eye on this.
Wow. Maybe Martin should have named this article, “Mozilla alienates user base with odd new new feature.”
If I were to use this feature, I think I would prefer to manually enter passwords once in each device, instead of uploading/downloading them to/from “somewhere” with every sync operation, and have them saved “somewhere” in an Internet server.
Someone should tell Mozilla that you can still copy encrypted files to the cloud and back. And that it is in fact preferable in this case to do it that way.