4 ms·

Firefox Sync is insecure and should not be used. This didn't used to be the case — it used to be world-class — but the engineers decided to utterly destroy its

Firefox Sync is insecure and should not be used. This didn't used to be the case — it used to be world-class — but the engineers decided to utterly destroy its security. All of your remote data is protected by whatever password you use, rather than by a high-entropy key (which means if you choose a poor password you might as well leave your data in plaintext). Worse, they use dynamically-downloaded JavaScript to handle your password, which means even if you use a high-entropy passphrase Mozilla can at any time send you malicious JavaScript and snarf your passphrase. This means that any government Mozilla must obey can do the same thing. Mozilla Accounts are thus fundamentally insecure and must not be used. It breaks my heart: they went from having the world's best password-sync security to having its worst. Even Google's system is quite so blatantly security-hostile. When your concern for your users is less than Google's, you really are doing something wrong.

staticassertion 9y ago
> All of your remote data is protected by whatever password you use, rather than by a high-entropy key (which means if you choose a poor password you might as well leave your data in plaintext). Can you elaborate on this? What do you mean by 'protected' and 'high entropy key'? It makes it sound like they aren't key stretching, which seems unlikely. Can you provide a source here? > Worse, they use dynamically-downloaded JavaScript to handle your password, which means even if you use a high-entropy passphrase Mozilla can at any time send you malicious JavaScript and snarf your passphrase. I'm unsure why you think Mozilla would do this, or why you would be using Firefox at all if you expect them to push malware to your system. > This means that any government Mozilla must obey can do the same thing. I'm not sure this is true, mostly because it lacks any sort of precedent.
- eadmund 9y ago
  > Can you elaborate on this? bscphil did a good job of it. They stretch the password into a key, but a 24-bits-of-entropy key still has only 24 bits of entropy, no matter how much you stretch it. Their previous system actually used properly-secure encryption keys. > I'm unsure why you think Mozilla would do this, or why you would be using Firefox at all if you expect them to push malware to your system. There's a difference between trusting them to provide a bit-for-bit identical binary to everyone, and trusting them to never send malicious JavaScript to one person. Downloads are public & could at least in theory be verified by the community at large, while a single JavaScript download could be subverted once and the world would never notice. As for the why — I explained why afterwards. Not just Mozilla has the ability to steal your passwords: any government which can force it to comply can also snarf your passwords. As for precedent, court orders require third parties to do things all the time. The only way to build a secure system is to build a system one couldn't subvert even if one wanted to, or were forced to. Mozilla completely, totally and utterly failed at that.
  - omnifischer 9y ago
    >As for the why — I explained why afterwards. Not just Mozilla has the ability to steal your passwords: any government which can force it to comply can also snarf your passwords. As for precedent, court orders require third parties to do things all the time. I would love to see if you can prove this. Please see their latest audit: https://blog.mozilla.org/security/2017/07/18/web-service-audits-firefox-accounts/ https://blog.mozilla.org/security/2017/07/18/web-service-aud... https://medium.com/mozilla-tech/how-firefox-sync-keeps-your-secrets-if-tls-fails-14420d45885c https://medium.com/mozilla-tech/how-firefox-sync-keeps-your-... When you enter your Firefox Account password, we first strengthen it by applying some cryptographic hashing, and then derive two separate keys: an authentication key, and an encryption key. The authentication key is transmitted to the server to prove that you own the account. A bug in TLS might cause this key to be leaked, and someone who intercepts this key could use it to authenticate to your account. But they cannot use it to access your sync data, because: The encryption key is used to encrypt your sync data before it leaves your machine. Since this key is never transmitted to the server, it cannot be leaked by a bug in TLS like the one that affected Cloudflare.
    - eadmund 9y ago
      > I would love to see if you can prove this. Go to https://accounts.firefox.com/signin https://accounts.firefox.com/signin and view source. Note that it loads https://accounts-static.cdn.mozilla.net/bundle-75dd38d5a7f98f7124a68dd54dae31af38cce107/appDependencies.bundle.js https://accounts-static.cdn.mozilla.net/bundle-75dd38d5a7f98... and https://accounts-static.cdn.mozilla.net/bundle-75dd38d5a7f98f7124a68dd54dae31af38cce107/app.bundle.en.js https://accounts-static.cdn.mozilla.net/bundle-75dd38d5a7f98.... The signin page itself may be edited at any time to point to different files, or to additional files, which load JavaScript which steals your password and sends it to Mozilla's servers. Game, set, match for your security.
- bscphil 9y ago
  >Can you elaborate on this? What do you mean by 'protected' and 'high entropy key'? I can't be sure, but I believe GP is referring to how Firefox Sync originally encrypted all the data locally with a long key before uploading it to Mozilla servers. To sync your data onto a new device you would have to transfer the key, which was done by generating a 16 char temporary password at one end, and then typing it at the other. Your private key data would then be sent, encrypted, to the new device. At some point, if memory serves, Mozilla decided this was too complicated for ordinary users, and now only stores your sync data protected by whatever password you type in - which is going to be potentially brute-forceable.
  - staticassertion 9y ago
    Got it - thanks, that's interesting. I'll probably check out how that worked.
omnifischer 9y ago
'This means that any government Mozilla must obey can do the same thing.' Please do not spread FUD. This is hn. Mozilla cannot see your passwords. See the latest security audit: https://blog.mozilla.org/security/2017/07/18/web-service-audits-firefox-accounts/ https://blog.mozilla.org/security/2017/07/18/web-service-aud... https://medium.com/mozilla-tech/how-firefox-sync-keeps-your-secrets-if-tls-fails-14420d45885c https://medium.com/mozilla-tech/how-firefox-sync-keeps-your-...
- eadmund 9y ago
  > Please do not spread FUD. This is hn. Mozilla cannot see your passwords. They process your password with JavaScript they deliver to your browser; they can at any time choose to deliver different, malicious JavaScript which sends them the raw password instead. It's not FUD; it's the honest truth. For details, see my note https://news.ycombinator.com/item?id=16565382 https://news.ycombinator.com/item?id=16565382

staticassertion 9y ago

> All of your remote data is protected by whatever password you use, rather than by a high-entropy key (which means if you choose a poor password you might as well leave your data in plaintext). Can you elaborate on this? What do you mean by 'protected' and 'high entropy key'? It makes it sound like they aren't key stretching, which seems unlikely. Can you provide a source here? > Worse, they use dynamically-downloaded JavaScript to handle your password, which means even if you use a high-entropy passphrase Mozilla can at any time send you malicious JavaScript and snarf your passphrase. I'm unsure why you think Mozilla would do this, or why you would be using Firefox at all if you expect them to push malware to your system. > This means that any government Mozilla must obey can do the same thing. I'm not sure this is true, mostly because it lacks any sort of precedent.

eadmund 9y ago
> Can you elaborate on this? bscphil did a good job of it. They stretch the password into a key, but a 24-bits-of-entropy key still has only 24 bits of entropy, no matter how much you stretch it. Their previous system actually used properly-secure encryption keys. > I'm unsure why you think Mozilla would do this, or why you would be using Firefox at all if you expect them to push malware to your system. There's a difference between trusting them to provide a bit-for-bit identical binary to everyone, and trusting them to never send malicious JavaScript to one person. Downloads are public & could at least in theory be verified by the community at large, while a single JavaScript download could be subverted once and the world would never notice. As for the why — I explained why afterwards. Not just Mozilla has the ability to steal your passwords: any government which can force it to comply can also snarf your passwords. As for precedent, court orders require third parties to do things all the time. The only way to build a secure system is to build a system one couldn't subvert even if one wanted to, or were forced to. Mozilla completely, totally and utterly failed at that.
- omnifischer 9y ago
  >As for the why — I explained why afterwards. Not just Mozilla has the ability to steal your passwords: any government which can force it to comply can also snarf your passwords. As for precedent, court orders require third parties to do things all the time. I would love to see if you can prove this. Please see their latest audit: https://blog.mozilla.org/security/2017/07/18/web-service-audits-firefox-accounts/ https://blog.mozilla.org/security/2017/07/18/web-service-aud... https://medium.com/mozilla-tech/how-firefox-sync-keeps-your-secrets-if-tls-fails-14420d45885c https://medium.com/mozilla-tech/how-firefox-sync-keeps-your-... When you enter your Firefox Account password, we first strengthen it by applying some cryptographic hashing, and then derive two separate keys: an authentication key, and an encryption key. The authentication key is transmitted to the server to prove that you own the account. A bug in TLS might cause this key to be leaked, and someone who intercepts this key could use it to authenticate to your account. But they cannot use it to access your sync data, because: The encryption key is used to encrypt your sync data before it leaves your machine. Since this key is never transmitted to the server, it cannot be leaked by a bug in TLS like the one that affected Cloudflare.
  - eadmund 9y ago
    > I would love to see if you can prove this. Go to https://accounts.firefox.com/signin https://accounts.firefox.com/signin and view source. Note that it loads https://accounts-static.cdn.mozilla.net/bundle-75dd38d5a7f98f7124a68dd54dae31af38cce107/appDependencies.bundle.js https://accounts-static.cdn.mozilla.net/bundle-75dd38d5a7f98... and https://accounts-static.cdn.mozilla.net/bundle-75dd38d5a7f98f7124a68dd54dae31af38cce107/app.bundle.en.js https://accounts-static.cdn.mozilla.net/bundle-75dd38d5a7f98.... The signin page itself may be edited at any time to point to different files, or to additional files, which load JavaScript which steals your password and sends it to Mozilla's servers. Game, set, match for your security.
bscphil 9y ago
>Can you elaborate on this? What do you mean by 'protected' and 'high entropy key'? I can't be sure, but I believe GP is referring to how Firefox Sync originally encrypted all the data locally with a long key before uploading it to Mozilla servers. To sync your data onto a new device you would have to transfer the key, which was done by generating a 16 char temporary password at one end, and then typing it at the other. Your private key data would then be sent, encrypted, to the new device. At some point, if memory serves, Mozilla decided this was too complicated for ordinary users, and now only stores your sync data protected by whatever password you type in - which is going to be potentially brute-forceable.
- staticassertion 9y ago
  Got it - thanks, that's interesting. I'll probably check out how that worked.

omnifischer 9y ago

'This means that any government Mozilla must obey can do the same thing.' Please do not spread FUD. This is hn. Mozilla cannot see your passwords. See the latest security audit: https://blog.mozilla.org/security/2017/07/18/web-service-audits-firefox-accounts/ https://blog.mozilla.org/security/2017/07/18/web-service-aud... https://medium.com/mozilla-tech/how-firefox-sync-keeps-your-secrets-if-tls-fails-14420d45885c https://medium.com/mozilla-tech/how-firefox-sync-keeps-your-...

eadmund 9y ago
> Please do not spread FUD. This is hn. Mozilla cannot see your passwords. They process your password with JavaScript they deliver to your browser; they can at any time choose to deliver different, malicious JavaScript which sends them the raw password instead. It's not FUD; it's the honest truth. For details, see my note https://news.ycombinator.com/item?id=16565382 https://news.ycombinator.com/item?id=16565382