6 ms·

Doesn’t client-side encryption effectively suppress the need to trust a third-party? Edit : I wasn't referring to this specific case, where encryption is done

by ealhad 9y ago

Doesn’t client-side encryption effectively suppress the need to trust a third-party? Edit : I wasn't referring to this specific case, where encryption is done with the code sent by a server.

blowski 9y ago
Can you trust the client side encryption?
ams6110 9y ago
Who is providing the encryption? If it's the same third party, there is a trust needed there.
bonyt 9y ago
You've still got to trust the software doing the encryption, and the other software on your machine that might be able to interact with the software doing the encryption (e.g., browser and other browser add-ons, particularly when using a browser-based client side encryption scheme).
- Xylakant 9y ago
  In this case, the software is open source, so the software can be evaluated.
  - zeveb 9y ago
    > In this case, the software is open source, so the software can be evaluated. You enter your password on a page Mozilla serve[0]; they can change the source of that page at any time, and for a single user. They could for example, send your password in the clear back to their servers if they wished. 0: https://www.mozilla.org/en-US/firefox/accounts/ https://www.mozilla.org/en-US/firefox/accounts/
    - Xylakant 9y ago
      All of this seems to be very alpha, but it's described as a standalone password manager and as far as I skimmed the docs, the firefox account doesn't necessarily seem to be a requirement. It might be something the extension requires, though.
      - zeveb 9y ago
        Ah, good point — I was thinking of the issues with Firefox Sync.
- blowski 9y ago
  And the hardware - the keyboard, the processor, etc. And the environment - your colleagues, any cameras. In the end, you have to give some trust to some people.
zeveb 9y ago
Mozilla's client-side encryption uses a key which is itself encrypted with your Firefox Account password — and Mozilla serve you the JavaScript used to log into your account, so they can steal your password whenever you log in using your web browser. There old password-storage system really was secure, but they end-of-lifed it.

by ealhad 9y ago

Doesn’t client-side encryption effectively suppress the need to trust a third-party? Edit : I wasn't referring to this specific case, where encryption is done with the code sent by a server.

blowski 9y ago

Can you trust the client side encryption?

ams6110 9y ago

Who is providing the encryption? If it's the same third party, there is a trust needed there.

bonyt 9y ago

You've still got to trust the software doing the encryption, and the other software on your machine that might be able to interact with the software doing the encryption (e.g., browser and other browser add-ons, particularly when using a browser-based client side encryption scheme).

Xylakant 9y ago
In this case, the software is open source, so the software can be evaluated.
- zeveb 9y ago
  > In this case, the software is open source, so the software can be evaluated. You enter your password on a page Mozilla serve[0]; they can change the source of that page at any time, and for a single user. They could for example, send your password in the clear back to their servers if they wished. 0: https://www.mozilla.org/en-US/firefox/accounts/ https://www.mozilla.org/en-US/firefox/accounts/
  - Xylakant 9y ago
    All of this seems to be very alpha, but it's described as a standalone password manager and as far as I skimmed the docs, the firefox account doesn't necessarily seem to be a requirement. It might be something the extension requires, though.
    - zeveb 9y ago
      Ah, good point — I was thinking of the issues with Firefox Sync.
blowski 9y ago
And the hardware - the keyboard, the processor, etc. And the environment - your colleagues, any cameras. In the end, you have to give some trust to some people.

zeveb 9y ago

Mozilla's client-side encryption uses a key which is itself encrypted with your Firefox Account password — and Mozilla serve you the JavaScript used to log into your account, so they can steal your password whenever you log in using your web browser. There old password-storage system really was secure, but they end-of-lifed it.