4 ms·

Remember kids, don't trust anyone with your passwords, not even Mozilla. That said, I enjoyed having a look at Mozilla's internal project management tool for t

Remember kids, don't trust anyone with your passwords, not even Mozilla. That said, I enjoyed having a look at Mozilla's internal project management tool for this extension, https://waffle.io/mozilla-lockbox/lockbox-extension https://waffle.io/mozilla-lockbox/lockbox-extension I wish I could have the same kind of look into other company's projects.

blowski 9y ago
“Don’t trust anyone” is a bit strong, and probably counterproductive. Be careful whom you trust is better.
- dwighttk 9y ago
  don't trust anyone: even the people with whom you are attempting to verify your identity using a password.
- ealhad 9y ago
  Doesn’t client-side encryption effectively suppress the need to trust a third-party? Edit : I wasn't referring to this specific case, where encryption is done with the code sent by a server.
  - blowski 9y ago
    Can you trust the client side encryption?
  - ams6110 9y ago
    Who is providing the encryption? If it's the same third party, there is a trust needed there.
  - bonyt 9y ago
    You've still got to trust the software doing the encryption, and the other software on your machine that might be able to interact with the software doing the encryption (e.g., browser and other browser add-ons, particularly when using a browser-based client side encryption scheme).
    - Xylakant 9y ago
      In this case, the software is open source, so the software can be evaluated.
      - zeveb 9y ago
        > In this case, the software is open source, so the software can be evaluated. You enter your password on a page Mozilla serve[0]; they can change the source of that page at any time, and for a single user. They could for example, send your password in the clear back to their servers if they wished. 0: https://www.mozilla.org/en-US/firefox/accounts/ https://www.mozilla.org/en-US/firefox/accounts/
        Xylakant 9y ago
        All of this seems to be very alpha, but it's described as a standalone password manager and as far as I skimmed the docs, the firefox account doesn't necessarily seem to be a requirement. It might be something the extension requires, though.
        zeveb 9y ago
        Ah, good point — I was thinking of the issues with Firefox Sync.
    - blowski 9y ago
      And the hardware - the keyboard, the processor, etc. And the environment - your colleagues, any cameras. In the end, you have to give some trust to some people.
  - zeveb 9y ago
    Mozilla's client-side encryption uses a key which is itself encrypted with your Firefox Account password — and Mozilla serve you the JavaScript used to log into your account, so they can steal your password whenever you log in using your web browser. There old password-storage system really was secure, but they end-of-lifed it.
daveFNbuck 9y ago
If you're using their browser, you're already trusting them with the password for every website you log in to.
- fwdpropaganda 9y ago
  Technically, yes, you're right. But in practice, the higher the visibility of the code you're relying on, the more likely it is that other people have caught something fishy. And POST is higher visibility than lockbox. This is also the reason why even though I trust Mozilla very much, I don't use Sync. It's lower visibility than the vanilla stuff. Also, attack surface.
  - daveFNbuck 9y ago
    That's a much more nuanced point than "don't trust anyone with your passwords." I agree with your reasoning, but that doesn't mean you shouldn't ever trust a password manager. It just means that you should have a high standard for when you should trust one. Not having a password manager opens up attack surfaces as well. Having a password manager integrated into my browser has prevented me from typing my password into a lookalike site from a different domain. It also means I don't use the same password for any two sites, and the password I use for each site is much stronger than it would otherwise be. There's the potential for the password manager to get compromised, but the benefits seem to outweigh that for now.

blowski 9y ago

“Don’t trust anyone” is a bit strong, and probably counterproductive. Be careful whom you trust is better.

dwighttk 9y ago
don't trust anyone: even the people with whom you are attempting to verify your identity using a password.
ealhad 9y ago
Doesn’t client-side encryption effectively suppress the need to trust a third-party? Edit : I wasn't referring to this specific case, where encryption is done with the code sent by a server.
- blowski 9y ago
  Can you trust the client side encryption?
- ams6110 9y ago
  Who is providing the encryption? If it's the same third party, there is a trust needed there.
- bonyt 9y ago
  You've still got to trust the software doing the encryption, and the other software on your machine that might be able to interact with the software doing the encryption (e.g., browser and other browser add-ons, particularly when using a browser-based client side encryption scheme).
  - Xylakant 9y ago
    In this case, the software is open source, so the software can be evaluated.
    - zeveb 9y ago
      > In this case, the software is open source, so the software can be evaluated. You enter your password on a page Mozilla serve[0]; they can change the source of that page at any time, and for a single user. They could for example, send your password in the clear back to their servers if they wished. 0: https://www.mozilla.org/en-US/firefox/accounts/ https://www.mozilla.org/en-US/firefox/accounts/
      - Xylakant 9y ago
        All of this seems to be very alpha, but it's described as a standalone password manager and as far as I skimmed the docs, the firefox account doesn't necessarily seem to be a requirement. It might be something the extension requires, though.
        zeveb 9y ago
        Ah, good point — I was thinking of the issues with Firefox Sync.
  - blowski 9y ago
    And the hardware - the keyboard, the processor, etc. And the environment - your colleagues, any cameras. In the end, you have to give some trust to some people.
- zeveb 9y ago
  Mozilla's client-side encryption uses a key which is itself encrypted with your Firefox Account password — and Mozilla serve you the JavaScript used to log into your account, so they can steal your password whenever you log in using your web browser. There old password-storage system really was secure, but they end-of-lifed it.

daveFNbuck 9y ago

If you're using their browser, you're already trusting them with the password for every website you log in to.

fwdpropaganda 9y ago
Technically, yes, you're right. But in practice, the higher the visibility of the code you're relying on, the more likely it is that other people have caught something fishy. And POST is higher visibility than lockbox. This is also the reason why even though I trust Mozilla very much, I don't use Sync. It's lower visibility than the vanilla stuff. Also, attack surface.
- daveFNbuck 9y ago
  That's a much more nuanced point than "don't trust anyone with your passwords." I agree with your reasoning, but that doesn't mean you shouldn't ever trust a password manager. It just means that you should have a high standard for when you should trust one. Not having a password manager opens up attack surfaces as well. Having a password manager integrated into my browser has prevented me from typing my password into a lookalike site from a different domain. It also means I don't use the same password for any two sites, and the password I use for each site is much stronger than it would otherwise be. There's the potential for the password manager to get compromised, but the benefits seem to outweigh that for now.