6 ms·

Of note, Firefox accounts are not secure, because one way to log in using them relies on JavaScript served by Mozilla, which means that one's password (which is

by zeveb 11y ago

Of note, Firefox accounts are not secure, because one way to log in using them relies on JavaScript served by Mozilla, which means that one's password (which is used to encrypt the keys encrypting all 'secure' data) is potentially exposed to Mozilla. I can't recommend using a Firefox account to store any private information, to include passwords and browsing history.

sdegutis 11y ago
What browser do you recommend then for real security?
- rockdoe 11y ago
  The browser is not the question. The problem is the cloud sync feature. What this has got to do with iOS? I guess people will want to use this to cloud sync their desktop Firefox?
- chao- 11y ago
  I don't think zeveb was saying the browser was insecure, just the "Firefox account" system which may be used to synchronize/store passwords and other IID.
  - sdegutis 11y ago
    Oh my mistake. Thanks for clarifying. So in that case, how would you securely sync your data using Firefox?
    - zeveb 11y ago
      > So in that case, how would you securely sync your data using Firefox? One can't, any longer. The old Sync system was quite secure, but Mozilla have disabled it.
Someone1234 11y ago
By that logic all cloud synced password managers are insecure. They could, after all, just update the software and steal your password(s). JavaScript or not, you either trust the browser vendor, or you do not. If you do not then you shouldn't be using them regardless of the technologic stack.
- rockdoe 11y ago
  This reasoning just doesn't apply at all to open source software like Firefox. I think the reason OP points this out is because the old Sync system that Firefox had was much more secure (but unusable by the general public). We know this because we could see how it worked!
  - Someone1234 11y ago
    > This reasoning just doesn't apply at all to open source software like Firefox. If you're using the automatic updating functionality (which the majority of people are) then it absolutely applies. Firefox's source code is available, but if you aren't verifying the source upon each update then that fact is largely irrelevant. The whole point of OSS is to allow YOU to verify the software, and only then to build it when you're comfortable. If you are skipping the verify step and definitely if you're skipping the build step then the fact that it is OSS adds little to nothing security wise (since the vendor can splice in anything they want). So even with OSS you often either trust the vendor or you do not. > I think the reason OP points this out is because the old Sync system that Firefox had was much more secure (but unusable by the general public). We know this because we could see how it worked! I suspect we're having this discussion simply because people don't equate the automatic updater with JavaScript in their own mind. The reality is that if you trust Mozilla to provide software updates then you can trust them to provide Javascript, after all the software brought down by the updater has far greater system access and can do far greater damage than JS.
    - zeveb 11y ago
      > If you're using the automatic updating functionality (which the majority of people are) then it absolutely applies. Which is why I don't get my updates via an automatic Mozilla updater, but rather via my distribution. > The reality is that if you trust Mozilla to provide software updates then you can trust them to provide Javascript As I indicate above, I don't trust them that much. You're right that the update problem and the JavaScript problem are identical. Allowing pushed updates makes individual targeting far too easy for an adversary.
Bognar 11y ago
So, you don't trust the JS served by Mozilla but you would trust their browser? That doesn't make much sense. Firefox could be sending all of your personal data straight to Mozilla, we just tend to trust that they don't (and can verify that they don't since the source is available).
- rockdoe 11y ago
  The JS that Mozilla serves (and the server that gets the reply) is potentially under control of the US government. Trust of Mozilla has got nothing to do with it. It shouldn't even be a requirement.
  - mahouse 11y ago
    Same with an app that is uploaded to the iOS App Store.
    - rockdoe 11y ago
      That's an excellent point.
- zeveb 11y ago
  > So, you don't trust the JS served by Mozilla but you would trust their browser? Mozilla's browser is shipped out to everyone; their JavaScript is served to me every time I use it. A compromised browser could be caught; compromised JavaScript sent one time only to a targeted user is highly unlikely to ever be noticed. I get my browser via a distribution; it's far less likely than Mozilla and Debian would collaborate to expose all of Debian's users' passwords than that Mozilla would target — or be compelled by law, blackmail or violence to target — a single user or handful of users.
vladikoff 11y ago
As others noted, this applies to all "Cloud" accounts, so: "Of note, your Dropbox, Google, Microsoft, Yahoo accounts are not secure, because JavaScript"
- thecatspaw 11y ago
  Dropbox, Google, Microsoft and Yahoo dont synchronize your passwords though
  - rockdoe 11y ago
    Google Chrome sure does.
- zeveb 11y ago
  Which is a huge reason not to use those accounts for truly secure stuff. Firefox used to be (reasonably) secure: on my Debian system, I could be (reasonably) certain Mozilla weren't able to steal my passwords. That's no longer the case, and it's a damn shame.

by zeveb 11y ago

sdegutis 11y ago

What browser do you recommend then for real security?

rockdoe 11y ago
The browser is not the question. The problem is the cloud sync feature. What this has got to do with iOS? I guess people will want to use this to cloud sync their desktop Firefox?
chao- 11y ago
I don't think zeveb was saying the browser was insecure, just the "Firefox account" system which may be used to synchronize/store passwords and other IID.
- sdegutis 11y ago
  Oh my mistake. Thanks for clarifying. So in that case, how would you securely sync your data using Firefox?
  - zeveb 11y ago
    > So in that case, how would you securely sync your data using Firefox? One can't, any longer. The old Sync system was quite secure, but Mozilla have disabled it.

Someone1234 11y ago

By that logic all cloud synced password managers are insecure. They could, after all, just update the software and steal your password(s). JavaScript or not, you either trust the browser vendor, or you do not. If you do not then you shouldn't be using them regardless of the technologic stack.

rockdoe 11y ago
This reasoning just doesn't apply at all to open source software like Firefox. I think the reason OP points this out is because the old Sync system that Firefox had was much more secure (but unusable by the general public). We know this because we could see how it worked!
- Someone1234 11y ago
  > This reasoning just doesn't apply at all to open source software like Firefox. If you're using the automatic updating functionality (which the majority of people are) then it absolutely applies. Firefox's source code is available, but if you aren't verifying the source upon each update then that fact is largely irrelevant. The whole point of OSS is to allow YOU to verify the software, and only then to build it when you're comfortable. If you are skipping the verify step and definitely if you're skipping the build step then the fact that it is OSS adds little to nothing security wise (since the vendor can splice in anything they want). So even with OSS you often either trust the vendor or you do not. > I think the reason OP points this out is because the old Sync system that Firefox had was much more secure (but unusable by the general public). We know this because we could see how it worked! I suspect we're having this discussion simply because people don't equate the automatic updater with JavaScript in their own mind. The reality is that if you trust Mozilla to provide software updates then you can trust them to provide Javascript, after all the software brought down by the updater has far greater system access and can do far greater damage than JS.
  - zeveb 11y ago
    > If you're using the automatic updating functionality (which the majority of people are) then it absolutely applies. Which is why I don't get my updates via an automatic Mozilla updater, but rather via my distribution. > The reality is that if you trust Mozilla to provide software updates then you can trust them to provide Javascript As I indicate above, I don't trust them that much. You're right that the update problem and the JavaScript problem are identical. Allowing pushed updates makes individual targeting far too easy for an adversary.

Bognar 11y ago

So, you don't trust the JS served by Mozilla but you would trust their browser? That doesn't make much sense. Firefox could be sending all of your personal data straight to Mozilla, we just tend to trust that they don't (and can verify that they don't since the source is available).

rockdoe 11y ago
The JS that Mozilla serves (and the server that gets the reply) is potentially under control of the US government. Trust of Mozilla has got nothing to do with it. It shouldn't even be a requirement.
- mahouse 11y ago
  Same with an app that is uploaded to the iOS App Store.
  - rockdoe 11y ago
    That's an excellent point.
zeveb 11y ago
> So, you don't trust the JS served by Mozilla but you would trust their browser? Mozilla's browser is shipped out to everyone; their JavaScript is served to me every time I use it. A compromised browser could be caught; compromised JavaScript sent one time only to a targeted user is highly unlikely to ever be noticed. I get my browser via a distribution; it's far less likely than Mozilla and Debian would collaborate to expose all of Debian's users' passwords than that Mozilla would target — or be compelled by law, blackmail or violence to target — a single user or handful of users.

vladikoff 11y ago

As others noted, this applies to all "Cloud" accounts, so: "Of note, your Dropbox, Google, Microsoft, Yahoo accounts are not secure, because JavaScript"

thecatspaw 11y ago
Dropbox, Google, Microsoft and Yahoo dont synchronize your passwords though
- rockdoe 11y ago
  Google Chrome sure does.
zeveb 11y ago
Which is a huge reason not to use those accounts for truly secure stuff. Firefox used to be (reasonably) secure: on my Debian system, I could be (reasonably) certain Mozilla weren't able to steal my passwords. That's no longer the case, and it's a damn shame.