3 ms·

Sign in to Firefox sync? It works for me. shrug

by PeCaN 10y ago

zeveb 10y ago
> Sign in to Firefox sync? Only do that if you don't mind that it is completely insecure. The password you sign in is used to encrypt the master key for your account (which means that if you can remember your password, Mozilla can decrypt your synced data). Worse, the login code is JavaScript served from Mozilla's servers, so they can at any time target one a send one's password anywhere they wish.
- pritambaral 10y ago
  Then host your own Firefox-Auth-Server and Firefox-Sync-Server. At least Mozilla has open-sourced those repos, and made their browsers capable of connecting to custom servers with a simple configuration change. But hey, you'd still be running Mozilla's code in and as your browser. As you say, they can "decrypt your synced data" and "at any time target one a send one's password anywhere they wish" even if you self-host the sync and auth servers. But at least Mozilla has a history of standing for the consumer and protecting user rights. And Firefox is perhaps the only browser that allows hosting your own sync and auth servers without having build your own copies of the browser.
  - zeveb 10y ago
    > Then host your own Firefox-Auth-Server and Firefox-Sync-Server. Only a server which you physically control — if it's in the cloud, it could be tampered with without your knowledge. And you must still use a high-entropy, unmemorable password. > But hey, you'd still be running Mozilla's code in and as your browser. There's a difference between trusting code at a point in time and trusting every single response ever. Sneaking a trojan into code which is visible to the world is hard; sneaking a trojan into a single targeted response is easy. > But at least Mozilla has a history of standing for the consumer and protecting user rights. Sure, but that doesn't protect you against a single bad employee or against any government which Mozilla is subject to. > And Firefox is perhaps the only browser that allows hosting your own sync and auth servers without having build your own copies of the browser. Yes, and I appreciate that. What really hurts is that Firefox used to have great sync security. I ran my own sync server for years, and was very happy with it. But when they revised the protocol they destroyed its security. Firefox Sync is unacceptable for password storage (as is every other sync system of which I'm aware). It's a distressing situation.
    - pritambaral 10y ago
      > Firefox used to have great sync security. I ran my own sync server for years, and was very happy with it. But when they revised the protocol they destroyed its security. Firefox Sync is unacceptable for password storage Oh, I'm unknowledgeable about this. Could you expand a bit on why it is insecure or what they did to it to make it insecure etc. Even just links would be enough.
      - zeveb 10y ago
        > Could you expand a bit on why it is insecure Sure thing. I'm referring to https://blog.mozilla.org/warner/2014/05/23/the-new-sync-protocol/ https://blog.mozilla.org/warner/2014/05/23/the-new-sync-prot... for details of the new protocol. Your synced data is encrypted with a 256-bit key kB. So far, so good. The problem is that kB is encrypted using a function of your Firefox Account password: if someone can guess or intercept your password, then he can decrypt kB and then decrypt any synced data. So, how hard is it to guess or intercept your password? Well, if you can remember your Firefox Account password, it's almost certainly guessable given enough machines. Human-memorable passwords almost never have high enough entropy to survive sustained attack. But maybe you store a truly high-entropy password (e.g. i2FH9E0G6PoCZm41C0pIJdLg1uOcGaA0GfhxKUtSQ) elsewhere, and enter it into the Firefox Account sign-in screen. Now no-one can guess your password, and that means that you're secure, right? Wrong: the Firefox Account sign-in screen (https://accounts.firefox.com/signin https://accounts.firefox.com/signin) is served from Mozilla's servers, which means that any time you visit it they may choose to serve JavaScript which transmits your password to them (normally they would perform all operations on your password locally). 'But I trust Mozilla to write Firefox!' you might argue. Sure, but it's (theoretically) possible to verify the Firefox source and binaries once; it's (theoretically) possible to verify that the source or binary they serve you is the same as that they serve to the rest of the world. With code delivered online, an attack can be targeted just once, at a single person: if you're not logging each and every login form's source code then you're exposed. A malicious (or compelled) Mozilla employee (or employees) could target a user; moreover, any government Mozilla is subject to could compel it to target a user. Their old system performed all operations locally, always; it never downloaded and then executed source. It was secure. Their new system is not much better than, 'trust us.'

by PeCaN 10y ago

zeveb 10y ago

> Sign in to Firefox sync? Only do that if you don't mind that it is completely insecure. The password you sign in is used to encrypt the master key for your account (which means that if you can remember your password, Mozilla can decrypt your synced data). Worse, the login code is JavaScript served from Mozilla's servers, so they can at any time target one a send one's password anywhere they wish.

pritambaral 10y ago
Then host your own Firefox-Auth-Server and Firefox-Sync-Server. At least Mozilla has open-sourced those repos, and made their browsers capable of connecting to custom servers with a simple configuration change. But hey, you'd still be running Mozilla's code in and as your browser. As you say, they can "decrypt your synced data" and "at any time target one a send one's password anywhere they wish" even if you self-host the sync and auth servers. But at least Mozilla has a history of standing for the consumer and protecting user rights. And Firefox is perhaps the only browser that allows hosting your own sync and auth servers without having build your own copies of the browser.
- zeveb 10y ago
  > Then host your own Firefox-Auth-Server and Firefox-Sync-Server. Only a server which you physically control — if it's in the cloud, it could be tampered with without your knowledge. And you must still use a high-entropy, unmemorable password. > But hey, you'd still be running Mozilla's code in and as your browser. There's a difference between trusting code at a point in time and trusting every single response ever. Sneaking a trojan into code which is visible to the world is hard; sneaking a trojan into a single targeted response is easy. > But at least Mozilla has a history of standing for the consumer and protecting user rights. Sure, but that doesn't protect you against a single bad employee or against any government which Mozilla is subject to. > And Firefox is perhaps the only browser that allows hosting your own sync and auth servers without having build your own copies of the browser. Yes, and I appreciate that. What really hurts is that Firefox used to have great sync security. I ran my own sync server for years, and was very happy with it. But when they revised the protocol they destroyed its security. Firefox Sync is unacceptable for password storage (as is every other sync system of which I'm aware). It's a distressing situation.
  - pritambaral 10y ago
    > Firefox used to have great sync security. I ran my own sync server for years, and was very happy with it. But when they revised the protocol they destroyed its security. Firefox Sync is unacceptable for password storage Oh, I'm unknowledgeable about this. Could you expand a bit on why it is insecure or what they did to it to make it insecure etc. Even just links would be enough.
    - zeveb 10y ago
      > Could you expand a bit on why it is insecure Sure thing. I'm referring to https://blog.mozilla.org/warner/2014/05/23/the-new-sync-protocol/ https://blog.mozilla.org/warner/2014/05/23/the-new-sync-prot... for details of the new protocol. Your synced data is encrypted with a 256-bit key kB. So far, so good. The problem is that kB is encrypted using a function of your Firefox Account password: if someone can guess or intercept your password, then he can decrypt kB and then decrypt any synced data. So, how hard is it to guess or intercept your password? Well, if you can remember your Firefox Account password, it's almost certainly guessable given enough machines. Human-memorable passwords almost never have high enough entropy to survive sustained attack. But maybe you store a truly high-entropy password (e.g. i2FH9E0G6PoCZm41C0pIJdLg1uOcGaA0GfhxKUtSQ) elsewhere, and enter it into the Firefox Account sign-in screen. Now no-one can guess your password, and that means that you're secure, right? Wrong: the Firefox Account sign-in screen (https://accounts.firefox.com/signin https://accounts.firefox.com/signin) is served from Mozilla's servers, which means that any time you visit it they may choose to serve JavaScript which transmits your password to them (normally they would perform all operations on your password locally). 'But I trust Mozilla to write Firefox!' you might argue. Sure, but it's (theoretically) possible to verify the Firefox source and binaries once; it's (theoretically) possible to verify that the source or binary they serve you is the same as that they serve to the rest of the world. With code delivered online, an attack can be targeted just once, at a single person: if you're not logging each and every login form's source code then you're exposed. A malicious (or compelled) Mozilla employee (or employees) could target a user; moreover, any government Mozilla is subject to could compel it to target a user. Their old system performed all operations locally, always; it never downloaded and then executed source. It was secure. Their new system is not much better than, 'trust us.'