--- a/toolkit/components/passwordmgr/LoginStore.jsm
+++ b/toolkit/components/passwordmgr/LoginStore.jsm
@@ -68,16 +68,17 @@ this.EXPORTED_SYMBOLS = [
 
 ////////////////////////////////////////////////////////////////////////////////
 //// Globals
 
 const { classes: Cc, interfaces: Ci, utils: Cu, results: Cr } = Components;
 
 Cu.import("resource://gre/modules/XPCOMUtils.jsm");
 Cu.import("resource://gre/modules/Task.jsm");
+Cu.import("resource://gre/modules/Services.jsm");
 
 XPCOMUtils.defineLazyModuleGetter(this, "AsyncShutdown",
                                   "resource://gre/modules/AsyncShutdown.jsm");
 XPCOMUtils.defineLazyModuleGetter(this, "DeferredTask",
                                   "resource://gre/modules/DeferredTask.jsm");
 XPCOMUtils.defineLazyModuleGetter(this, "FileUtils",
                                   "resource://gre/modules/FileUtils.jsm");
 XPCOMUtils.defineLazyModuleGetter(this, "OS",
@@ -106,17 +107,20 @@ const kSaveDelayMs = 1500;
  * This number should be updated only when it is important to understand whether
  * an old version of the code has touched the data, for example to execute an
  * update logic.  In most cases, this number should not be changed, in
  * particular when no special one-time update logic is needed.
  *
  * For example, this number should NOT be changed when a new optional field is
  * added to a login entry.
  */
-const kDataVersion = 1;
+const kDataVersion = 2;
+
+// The permission type we store in the permission manager.
+const PERMISSION_SAVE_LOGINS = "login-saving";
 
 ////////////////////////////////////////////////////////////////////////////////
 //// LoginStore
 
 /**
  * Handles serialization of login-related data and persistence into a file.
  *
  * @param aPath
@@ -263,27 +267,49 @@ LoginStore.prototype = {
    * Synchronously work on the data just loaded into memory.
    */
   _processLoadedData: function ()
   {
     // Create any arrays that are not present in the saved file.
     if (!this.data.logins) {
       this.data.logins = [];
     }
+
+    // Stub needed for login imports before data has been migrated.
     if (!this.data.disabledHosts) {
       this.data.disabledHosts = [];
     }
 
+    if (this.data.version === 1) {
+      this._migrateDisabledHosts();
+    }
+
     // Indicate that the current version of the code has touched the file.
     this.data.version = kDataVersion;
 
     this.dataReady = true;
   },
 
   /**
+   * Migrates disabled hosts to the permission manager.
+   */
+  _migrateDisabledHosts: function () {
+    for (let host of this.data.disabledHosts) {
+      try {
+        let uri = Services.io.newURI(host, null, null);
+        Services.perms.add(uri, PERMISSION_SAVE_LOGINS, Services.perms.DENY_ACTION);
+      } catch (e) {
+        Cu.reportError(e);
+      }
+    }
+
+    delete this.data.disabledHosts;
+  },
+
+  /**
    * Called when the data changed, this triggers asynchronous serialization.
    */
   saveSoon: function ()
   {
     return this._saver.arm();
   },
 
   /**

--- a/toolkit/components/passwordmgr/storage-json.js
+++ b/toolkit/components/passwordmgr/storage-json.js
@@ -361,18 +361,16 @@ this.LoginManagerStorage_json.prototype 
 
     this.log("_searchLogins: returning", foundLogins.length, "logins for", matchData,
              "with options", aOptions);
     return [foundLogins, foundIds];
   },
 
   /**
    * Removes all logins from storage.
-   *
-   * Disabled hosts are kept, as one presumably doesn't want to erase those.
    */
   removeAllLogins() {
     this._store.ensureDataReady();
 
     this.log("Removing all logins");
     this._store.data.logins = [];
     this._store.saveSoon();