4 ms·

I agree that is a valid issue, but it's still quite a different scale than using Google. If I understand correctly, you're saying that we should be careful abo

by mgbmtl 9y ago

I agree that is a valid issue, but it's still quite a different scale than using Google. If I understand correctly, you're saying that we should be careful about saving passwords in Firefox if we could be the target of a National Security Letter from the US. The attack would be detectable, so it cannot be used very often (and they would need a really good excuse for doing so). By contrast, Google takes all our data and can do whatever they want with it, without a warrant/NSL?

zeveb 9y ago
Oh, I certainly don't recommend Google over Firefox. But I do not recommend using Firefox's Sync functionality, which is indeed insecure by design. I have no idea why so many downvotes. Can anyone disagree that a system in which Mozilla is able to decrypt user data is insecure? One note: the attack is not necessarily detectable, unless you are in the practice of verifying the JavaScript you receive for each page. If there were some public registry of hashed versions of Mozilla-served JavaScript, it would be detectable. Also, you need not worry only about the U.S. government, but also about any government which can compel Mozilla to act, and any government which can compel an employee of Mozilla to act, and finally any employees at Mozilla with access. And also you need to worry about bugs in Mozilla's JavaScript: since they did not design a system in which they can't know your password (which is the key to all your secrets), an implementation error might send them your password (and thus allow them to decrypt all your secrets).
- mgbmtl 9y ago
  We can run our own Firefox Account servers. A privacy-focused hosting co-op could run that as part of their services, or someone could run their own at home (but that's not useful to the general public). People get annoyed of being told x-y-z is not secure, while not being offered any practical solution, especially if the risk/probability of attack is low. (I'm assuming Firefox has a good reason for working the way it does, but I guess the first step would be to have more documentation about that.)
  - zeveb 9y ago
    > We can run our own Firefox Account servers. Which can themselves be compromised. The old Firefox Sync protocol was immune to remote compromise, completely and totally. > People get annoyed of being told x-y-z is not secure, while not being offered any practical solution I agree: the problem is that there was a practical solution: just keep the old Sync protocol. > I'm assuming Firefox has a good reason for working the way it does The short version is that people wanted to be able to only have one device and still get at their data, and Mozilla didn't want to confuse them by separating their account passwords and their sync passwords. Never mind that combining them has results in a wholesale loss of security.

by mgbmtl 9y ago

zeveb 9y ago

Oh, I certainly don't recommend Google over Firefox. But I do not recommend using Firefox's Sync functionality, which is indeed insecure by design. I have no idea why so many downvotes. Can anyone disagree that a system in which Mozilla is able to decrypt user data is insecure? One note: the attack is not necessarily detectable, unless you are in the practice of verifying the JavaScript you receive for each page. If there were some public registry of hashed versions of Mozilla-served JavaScript, it would be detectable. Also, you need not worry only about the U.S. government, but also about any government which can compel Mozilla to act, and any government which can compel an employee of Mozilla to act, and finally any employees at Mozilla with access. And also you need to worry about bugs in Mozilla's JavaScript: since they did not design a system in which they can't know your password (which is the key to all your secrets), an implementation error might send them your password (and thus allow them to decrypt all your secrets).

mgbmtl 9y ago
We can run our own Firefox Account servers. A privacy-focused hosting co-op could run that as part of their services, or someone could run their own at home (but that's not useful to the general public). People get annoyed of being told x-y-z is not secure, while not being offered any practical solution, especially if the risk/probability of attack is low. (I'm assuming Firefox has a good reason for working the way it does, but I guess the first step would be to have more documentation about that.)
- zeveb 9y ago
  > We can run our own Firefox Account servers. Which can themselves be compromised. The old Firefox Sync protocol was immune to remote compromise, completely and totally. > People get annoyed of being told x-y-z is not secure, while not being offered any practical solution I agree: the problem is that there was a practical solution: just keep the old Sync protocol. > I'm assuming Firefox has a good reason for working the way it does The short version is that people wanted to be able to only have one device and still get at their data, and Mozilla didn't want to confuse them by separating their account passwords and their sync passwords. Never mind that combining them has results in a wholesale loss of security.