MozillaZine

Master password

From MozillaZine Knowledge Base

(Difference between revisions)
Revision as of 00:53, 14 November 2010
Tanstaafl (Talk | contribs)
(Removed some obsolete version specific information - still supports last major obsolete versions)
<-- Previous diff
Revision as of 01:18, 14 November 2010
Tanstaafl (Talk | contribs)
(Merged Firefox and Thunderbird unable to reset master password to make rerset master password section cleaner)
Next diff -->
Line 6: Line 6:
Using a master password is not selected by default; you will need to set one in the [[Password Manager]], as explained below under [[#Setting a master password|Setting a master password]]. You can view using a master password as a way to authenticate who you are to the ''Software Security Device'', just as you do with a server on a web site: you log into a web site and enter your credentials and you do the same if supplying the master password. Using a master password is not selected by default; you will need to set one in the [[Password Manager]], as explained below under [[#Setting a master password|Setting a master password]]. You can view using a master password as a way to authenticate who you are to the ''Software Security Device'', just as you do with a server on a web site: you log into a web site and enter your credentials and you do the same if supplying the master password.
-If you supply the ''Master Password'' in the popup window that you see if a master password is needed, then you log in to the ''Software Security Device'' (In Firefox 2 and above: "[[Menu differences in Windows, Linux, and Mac|Tools > Options]] > Advanced > Encryption: Certificates: Security Devices: Software Security Device"). If you select the ''Software Security Device'' then you notice an enabled "Log Out" button if you are logged on, otherwise the "Log In" button is enabled in that window.+If you supply the ''Master Password'' in the popup window that you see if a master password is needed, then you log in to the ''Software Security Device'' (Firefox uses: "[[Menu differences in Windows, Linux, and Mac|Tools -> Options]] -> Advanced -> Encryption: Certificates: Security Devices: Software Security Device"). If you select the ''Software Security Device'' then you notice an enabled "Log Out" button if you are logged on, otherwise the "Log In" button is enabled in that window.
Access to the encrypted names and passwords is possible as long as you are logged on to the ''Software Security Device'' and you need to log out to prevent others from accessing that data if you leave your computer unattended. Access to the encrypted names and passwords is possible as long as you are logged on to the ''Software Security Device'' and you need to log out to prevent others from accessing that data if you leave your computer unattended.
"Tools > Clear Private Data : Authenticated sessions" does the same, but also additionally will log you out of secure web sites. You may need to clear the [[cookies]] to log out of other sites. "Tools > Clear Private Data : Authenticated sessions" does the same, but also additionally will log you out of secure web sites. You may need to clear the [[cookies]] to log out of other sites.
Line 30: Line 30:
If you have lost or forgotten your master password or you want to disable the feature, you can reset the master password. '''Resetting the master password will remove all stored password information.''' Upon resetting, you will lose all the stored information in the Password Manager, as this is a built-in security feature to prevent people from simply resetting your Master Password to gain access to your passwords. If you have lost or forgotten your master password or you want to disable the feature, you can reset the master password. '''Resetting the master password will remove all stored password information.''' Upon resetting, you will lose all the stored information in the Password Manager, as this is a built-in security feature to prevent people from simply resetting your Master Password to gain access to your passwords.
-For Firefox, you can also look at the Troubleshooting section of the [[Password Manager]] article. 
* Firefox: Enter <code>chrome://pippki/content/resetpassword.xul</code> into the Location Bar (address bar), press the "Enter" key and click "Reset". * Firefox: Enter <code>chrome://pippki/content/resetpassword.xul</code> into the Location Bar (address bar), press the "Enter" key and click "Reset".
-* Thunderbird: Choose Tools &ndash; Error Console, paste the expression: <code>openDialog("chrome://pippki/content/resetpassword.xul")</code> and press the Evaluate button. That will open a dialog asking you if you want to reset your password.+* Thunderbird: Choose Tools -> Error Console, paste the expression: <code>openDialog("chrome://pippki/content/resetpassword.xul")</code> and press the Evaluate button. That will open a dialog asking you if you want to reset your password.
* Mozilla Suite/SeaMonkey: "[[Menu differences in Windows, Linux, and Mac|Edit -> Preferences]] -> Privacy & Security -> Master Passwords -> Reset Password". * Mozilla Suite/SeaMonkey: "[[Menu differences in Windows, Linux, and Mac|Edit -> Preferences]] -> Privacy & Security -> Master Passwords -> Reset Password".
-Note: Upon initial installation, Firefox sometimes believes it has a master password in effect and the user is unable to change or remove it because the set master password is unknown to the user [http://forums.mozillazine.org/viewtopic.php?t=110487]. This situation sometimes occurs when a Mozilla Suite/SeaMonkey profile's passwords are imported into Firefox at install time. If this happens, [[#Resetting the master password|reset the master password]] as explained above.+==Asked for a master password despite never setting one==
 +===Firefox===
 +Sometimes when you install Firefox and import passwords from a Mozilla Suite or SeaMonkey profile that causes Firefox to think you set a master password even though you never created one. [http://forums.mozillazine.org/viewtopic.php?t=110487]. If this happens, [[#Resetting the master password|reset the master password]] as explained above.
-If resetting the Master Password via the chrome url didn't work then you need to remove the files that store the encryption key ([[key3.db]]) and the saved names and passwords ([[signons.sqlite]] and possible leftover files [[signons3.txt|signons#.txt]] from previous Firefox versions).<br />+If that doesn't work exit Firefox and delete the encryption keys ([[key3.db]]), the saved names and passwords ([[signons.sqlite]] and any possible leftover files [[signons3.txt|signons#.txt]] from previous Firefox versions) in your [[Profile_folder_-_Firefox profile | profile]] . If that doesn't work see [[Password_Manager#Troubleshooting]].
-See [[Password_Manager#Troubleshooting]]+
-==Asked for a master password after upgrading despite never setting one==+===Thunderbird===
- +There is a [https://bugzilla.mozilla.org/show_bug.cgi?id=506638#c57 known bug] that sometimes occurs when updating from 2.0.0.24 to Thunderbird 3.* that causes Thunderbird to think you set a master password even though you never created one. If this happens, try [[#Resetting the master password|resetting the master password]] as explained above. If that doesn't work exit Thunderbird and delete the key3.db file in your [[/Profile_folder_-_Thunderbird | profile]].
-There is a [https://bugzilla.mozilla.org/show_bug.cgi?id=506638#c57 known bug] that sometimes occurs when updating from 2.0.0.24 to Thunderbird 3.* that causes Thunderbird to think you set a master password when you didn't. Typically when this problem occurs you can't use the normal way to reset the master password. +
- +
-There are several workarounds. You only need to chose one. However, you need to remember what your passwords are so that later on when you're prompted for them again you can enter them and tell the password wizard to save them. +
- +
-* Open the error console using tools -> error console and paste ''openDialog("chrome://pippki/content/resetpassword.xul")'' and then press the Evaluate button. That will ask you if you want to reset the master password. +
- +
-* Exit Thunderbird. Delete the key3.db file in your [[/Profile_folder_-_Thunderbird | profile]].+
==External links== ==External links==

Revision as of 01:18, 14 November 2010

If you share your computer, using a Master Password is highly recommended, to prevent other users from accessing your stored passwords and logging onto your online accounts and services. Stored passwords can include webmail and forum account information for browsers and e-mail server passwords for mail readers. By setting a Master Password, anyone using your profile will be prompted to enter the master password when access to your stored passwords is needed. You will also need to setup a master password if you wish to install S/MIME certificates.

A master password will not prevent others from reading locally stored e-mails, reading your browsing history, or from accessing sites the browser is already logged in to.

Contents

Using a master password

Using a master password is not selected by default; you will need to set one in the Password Manager, as explained below under Setting a master password. You can view using a master password as a way to authenticate who you are to the Software Security Device, just as you do with a server on a web site: you log into a web site and enter your credentials and you do the same if supplying the master password.

If you supply the Master Password in the popup window that you see if a master password is needed, then you log in to the Software Security Device (Firefox uses: "Tools -> Options -> Advanced -> Encryption: Certificates: Security Devices: Software Security Device"). If you select the Software Security Device then you notice an enabled "Log Out" button if you are logged on, otherwise the "Log In" button is enabled in that window. Access to the encrypted names and passwords is possible as long as you are logged on to the Software Security Device and you need to log out to prevent others from accessing that data if you leave your computer unattended. "Tools > Clear Private Data : Authenticated sessions" does the same, but also additionally will log you out of secure web sites. You may need to clear the cookies to log out of other sites.

Setting a master password

  • Firefox: "Tools -> Options -> Security / Passwords -> Use a master password"
  • Thunderbird: "Tools -> Options -> Privacy -> Passwords -> Set Master Password"
  • Mozilla Suite/SeaMonkey: "Edit -> Preferences -> Privacy & Security -> Master Passwords -> Change Password"

Make sure that you are able to remember or otherwise retrieve the master password you choose. For security reasons, you will need to supply your current master password before you can change or remove it.

Changing your master password

  • Firefox: "Tools -> Options -> Security / Passwords -> Change Master Password"
  • Thunderbird: "Tools -> Options -> Privacy -> Passwords -> Change Master Password" (not shown unless a master password is set)
  • Mozilla Suite/SeaMonkey: "Edit -> Preferences -> Privacy & Security -> Master Passwords -> Change Password"

Removing your master password

  • Firefox: "Tools -> Options -> Security / Passwords -> Uncheck "Use a master password". You will be prompted for your Master Password.
  • Thunderbird: "Tools -> Options -> Privacy -> Passwords -> Remove Master Password"

Resetting the master password

If you have lost or forgotten your master password or you want to disable the feature, you can reset the master password. Resetting the master password will remove all stored password information. Upon resetting, you will lose all the stored information in the Password Manager, as this is a built-in security feature to prevent people from simply resetting your Master Password to gain access to your passwords.

  • Firefox: Enter chrome://pippki/content/resetpassword.xul into the Location Bar (address bar), press the "Enter" key and click "Reset".
  • Thunderbird: Choose Tools -> Error Console, paste the expression: openDialog("chrome://pippki/content/resetpassword.xul") and press the Evaluate button. That will open a dialog asking you if you want to reset your password.
  • Mozilla Suite/SeaMonkey: "Edit -> Preferences -> Privacy & Security -> Master Passwords -> Reset Password".

Asked for a master password despite never setting one

Firefox

Sometimes when you install Firefox and import passwords from a Mozilla Suite or SeaMonkey profile that causes Firefox to think you set a master password even though you never created one. [1]. If this happens, reset the master password as explained above.

If that doesn't work exit Firefox and delete the encryption keys (key3.db), the saved names and passwords (signons.sqlite and any possible leftover files signons#.txt from previous Firefox versions) in your profile . If that doesn't work see Password_Manager#Troubleshooting.

Thunderbird

There is a known bug that sometimes occurs when updating from 2.0.0.24 to Thunderbird 3.* that causes Thunderbird to think you set a master password even though you never created one. If this happens, try resetting the master password as explained above. If that doesn't work exit Thunderbird and delete the key3.db file in your profile.

External links