2

Today I created a new profile on a fresh install of Thunderbird Version 78.2.2 on Windows 10 (Build 19041). When clicking the "Use a master password" checkbox, a password prompt pops up, asking me for the password of my Windows account (see screenshot -- the greyed out portions are my account name). I'm told that the same thing happens in Firefox.

It seems like a legitimate prompt from the Windows operating system. But I'm a little confused as to why it is needed. Does it use some kind of keyring built into Windows to store the passwords? Does creating a keyring in Windows require the account password?

Regarding credential storage, it appears that Thunderbird didn't create anything under Control Panel\User Accounts\Credential Manager, according to the "Last Modified" timestamp. So that's not the reason.

Image of popup dialog asking for Windows account password

Improve this question
5
  • Mozilla made this change over a year ago for additional security. Firefox would also require it. – Ramhound Sep 18 '20 at 17:19
  • @Ramhound: Ah, thanks for the hint. But what does it do with the account password? Do you have a link to more information, like the initial announcement? My search turned up nothing relevant. – Fritz Sep 18 '20 at 17:40
  • Or is it just to verify that I'm really me, and nobody else is encrypting my passwords while I'm away from the PC? – Fritz Sep 18 '20 at 17:47
  • You asked why it’s happening, that would require a Thunderbird developer to explain, I only know that the changed also happened to Firefox’s master password for additional security. I recall reading a support article on the Mozilla website. What has your research shown? – Ramhound Sep 18 '20 at 23:15
  • @Ramhound: I found it. See my answer for details. Thanks for your help. – Fritz Sep 20 '20 at 20:30
2

TL;DR

It does not do anything with your Windows account or with your Windows password. It is just there to verify that it is really YOU in front of the PC. (Full story below)

The Full Story

Thanks to the comments by @Ramhound, I was able to refine my web search to include Firefox, in addition to Thunderbird. That turned up more search results. Here's what I found out:

  1. First of all, Thunderbird (and Firefox) stores all your stored passwords unencrypted[Note 1] on your hard drive.

  2. Before Firefox 76, anyone using your PC could open the Firefox/Thunderbird settings and click Show Saved Passwords to reveal all your secrets without any access control.

  3. To prevent that, Mozilla developers added that Windows account password prompt that this question is about. When you click Show Saved Passwords, it will now ask you for your Windows password, to prevent people from casually looking at your passwords while you are away for a second. For example your (hypothetical) nosy colleagues when you forget to lock your PC while getting a coffee.

  4. The Windows account password is not used for anything other than making sure that the user in front of the PC is really YOU. It is not used to encrypt your stored passwords or doing anything related to security. Anyone with access to your account can still read all the unencrypted passwords from your hard drive, if they know where to look.

    Riadh Chtara wrote:

    [...] In the current bug we dont change how the password are stored, we just use an api to ask him for his windows password: it s a bit cheating so the normal users feel more secure, and he is indeed more secure against normal people attacks, however in the a background: advanced user can still get the passwords. [...]

    Corollary: This feature is less secure than locking your PC. [Note 2]

  5. Creating a Primary Password[Note 3] is the same as accessing all your stored passwords, because all your existing (unencrypted) stored passwords are transferred to the new encrypted Primary Password storage. From now on you will need to enter your Primary Password instead of your Windows password when clicking Show Saved Passwords.

    So in order to prevent your (hypothetical) nosy colleagues from bypassing the Windows password prompt by setting Primary Password, Firefox/Thunderbird needs to ask for the Windows password before it lets you create a Primary Password.

    Jared Wein wrote:

    The OS auth before setting a Master Password is required since having a Master Password set will supersede the OS authentication.

My Personal Conclusion

This feature is just there to prevent the most basic attack by the most unskilled attacker imaginable. And to annoy its users, apparently, because Mozilla quickly disabled the feature after the initial release of Firefox 76 due to a user outcry. Apparently it was now reintroduced (at least to Thunderbird, I don't use Firefox so I can't confirm).

Note 1: Okay, technically they are encrypted, but the encryption key sits right next to the encrypted passwords in your profile folder. So anyone with access to your user account has access to your stored Firefox/Thunderbird passwords. Unless you set a master password.

Note 2: Additionally, it's a very poor design decision to ask for the operating system password for anything but signing in to the operating system. If you teach users that it's okay to enter the their Windows password in their web browser, you open the door for all kinds of scams. Websites could easily fake this Windows login prompt. And yes, scientific studies have been done on exactly that topic, where up to 20% of unwitting users fell for that ploy.

Note 3: It is now called Primary Password, instead of Master Password because of the origin of the term "master".

Improve this answer
5
  • I would prefere to (further) separate "your conclusion" from the "facts". But other then that a nice answer, thx. – Albin Sep 21 '20 at 8:54
  • @Albin: Thanks. Is it better this way? – Fritz Sep 22 '20 at 19:05
  • yeah, looks good to me :) – Albin Sep 22 '20 at 20:15
  • on Linux it's common to ask for the OS password when you're not signing in, for example to run sudo – phuclv Sep 22 '20 at 23:08
  • @phuclv: Yes, but that's usually something that you trigger yourself when making administrative changes to your system (like installing software, changing system config files) and not something that any random software triggers without a clear explanation what those admin privileges are used for. – Fritz Sep 23 '20 at 11:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.