Are the memorized passwords in plain english? See Sallie Mae Website

Question

I was just on the Sallie Mae payment website and they have a warning that memorized passwords can be accessed in plain English. I thought the passwords were suppose to be secure and encrypted. Is there an update that needs to be installed. Very concerning.

Answer 1

They stored encrypted in signons.sqlite even if you do not use a MP, but having access to the key3.db file is sufficient to decrypt them and the Password Manager will also show them if you copy the two files to another profile folder or computer.
The names and passwords stored in signons.sqlite are encrypted with a Triple DES key (CBC mode) that is stored in key3.db and a master password adds an additional level to this encryption.<br />
If you do not use a master password then having access to key3.db and signons.sqlite is sufficient to have access to the encrypted names and passwords by placing the two files in a Firefox profile folder.<br />
Always use a strong master password (e.g at least 12 characters) that can't be easily guessed or found via a dictionary look up or a script and you should be safe.<br />
Make sure that you remember that master password or else all your passwords are lost.<br />
You always need the matching file key3.db that was used to create a signons.sqlite file to make it possible to decrypt signons.sqlite.