Unlike Firefox desktop, Firefox Android has no master password protection. All passwords in the password store are accessible simply by clicking on the password store once the phone is unlocked, which might be protected by nothing more than a relatively weak swipe pattern. Instructions to set a long/complex screenlock password for their devices is the usual response to this, but this not an intelligent solution for many users as it is overkill for all purposes except their password store.
Another potential security issue that arises from this is that users may disable password sync on their mobiles for the above reason but still accidentally sync all their passwords to mobile as a result of syncing from desktop, no realizing this config change on their desktop also propagates automatically to their mobile devices. Or perhaps when using a particular device again after a long time without use, failing to remember they have updated their sync settings on desktop.
The obvious solution to all this is a master password option like on desktop. Why has Mozilla never given the mobile version this option?
Dale.
