3 ms·
The old Firefox sync used a local-only passphrase to encrypt things. The new one, as far as I can tell, just tires everything to your Firefox Account (i.e. noth
by mook 10y ago
The old Firefox sync used a local-only passphrase to encrypt things. The new one, as far as I can tell, just tires everything to your Firefox Account (i.e. nothing local is required). That's not really better than what 1Password does, I think.
- JoshTriplett 10y agoThe current Firefox Sync (based on Firefox Accounts) still keeps everything client-side encrypted, rooted in password-derived keys and locally generated keys. It never sends the password to the server.
- zeveb 10y ago> It never sends the password to the server. It does, however, download JavaScript served by Mozilla when you log into your Firefox Account, which means that Mozilla can cause your password to be sent to them unencrypted, if they so choose. This in turns means that a disgruntled employee, Mozilla the organization and any government which is able to compel Mozilla the organization or key employees can get access to your password at any time, rendering Firefox Sync completely untrustworthy.
- JoshTriplett 10y agoThat only occurs when you log into your Firefox Account via the web-based system, which necessarily has to use JavaScript to provide a client. If you log in via your browser, all the code lives in the browser. Or, if you prefer, you could run a self-hosted version of Firefox Accounts on your own server.