[HOW-TO] Secure your Firefox profile from data-thief

There is a possibility of accessing the encrypted passwords through brute-force, but the timeframe should be big enough between the moment you discover that you lost the thumbdrive so you can do a password change.

I should verify what kind of encryption is used by the Master Password feature (AES, Twofish, Serpent ?). Somebody know that information just in case before I start searching ?

One thing I'd like to see is an extension that encrypt the cookies and session information with the Master Password key. That would be awesome for portable users like us, if the encryption is secure enough.

EDIT: Downloading Firefox 3.0 final source code, I'm really curious about this. I'll post about it later.

I've finally found the information regarding the password encryption in Firefox.

Source (securityfocus.com)
4.2.2 Firefox 0.7-1.5 and 2.0

Storage Construct: Text File (signons.txt)
Format: ASCII, using Base64 encoding (except URL and fields)

URL (clear text, i.e. www.gmail.com)
Field name (in cleartext, e.g. username, email, userid, etc.)
Encrypted and Base64 encoded value of above information
Field name (i.e. password, pass, etc.)
Encrypted and Base64 encoded value of above information
...etc... (Could have many entries for one URL)
.
(Each URL entry ends with period on separate to line)

Encryption: TripleDES (CBC mode) [ref 16]
Access: Network Security Services (NSS) API [ref 17]
Requirements for Access: User logged in and the Master Password (if set)
Relevant files: Certificates (Signed Public Keys) stored as certN.db, Private Key Database stored as keyN.db, and Security Modules stored as secmod.db [ref 18]

Note that files locations were previously addressed in section 4.1.

Firefox uses the Network Security Services API to perform its cryptographic operations. As it relates to the Password Manager Firefox makes use of Public Key Cryptography Standard (PKCS) #11 [ref 19] which defines an API for third party security modules that are either software or hardware based. It also uses PKCS#5 for password based encryption. [ref 19] Firefox also has an option of using an alternative security module for the password manager that is Federal Information Processing Standard (FIPS) 140-1 compliant. [ref 20] The Master Password is used in conjunction with a salt (found in the keyN.db file) is used to derive a Master Key. The Master Key is then in turn used to decrypt the usernames, passwords that are stored in the Password Manager.

The NSS API, although not easily tackled, has some vital functions that let Firefox or a related program to gain access to the password database. Setting the password is handled by (PK11_SetPasswordFunc), decoding base64 data (NSSBase64_DecodeBuffer), and decrypting (PK11SDR_Decrypt) allows a related program to access usernames and associated passwords; this is of course a simplified example. The real code would need to initialize NSS, declare variables, manage buffers and so forth. The security of the entire system, however, weights on the cryptographic strength of the Master Password (created by the user), and accessibility to the key3.db file (which contains the salt), and is stored in the user's profile.

The FIPS 140-1 security module can be enabled by navigating to the following location:

Firefox 1.5 on Windows:

Tools | Options | Advanced | Security Devices | NSS Internal FIPS PKCS #11

Firefox 2.0 on Windows:

Tools | Options | Advanced | Encryption | Security Devices | NSS Internal FIPS PKCS #11