12 ms·
Firefox Lockbox
- jonny_eh 8y agoA chrome extension would be great!
- devinreams 8y agoWe hear ya and we're thinking about it. But, it would be a while before we started to build one. An Android app is up next up on our list...
- jumbopapa 8y agoThis is seriously great! If the eventual Android app uses the Autofill API then it would be a good replacement for LastPass or Bitwarden.
- godelski 8y agoSo can someone expand on this a little? What are the differences between this and something like LastPass (other than this isn't an add-on). Does it provide app autofill? Does it prevent the same plain text decoding that browser password managers typically have? Is this useful? I'm legit asking because I don't know and would appreciate a security person chiming in.
- sp332 8y agoThe video shows the password being copied (to a clipboard), so I'm guessing it doesn't do autofill. Does iOS support autofill apps?
- nyolfen 8y agolastpass on ios autofills if you select it from the safari, uh, box-with-up-arrow icon from the navigation bar
- sametmax 8y agoOp said in apps.
- xyclos 8y agoAs of iOS 12: https://developer.apple.com/documentation/authenticationservices https://developer.apple.com/documentation/authenticationserv...
- kyoji 8y agoLove it. I don't love using LastPass, but I don't want to deal with the rough edges of KeePass either. Looking forward to the Android app. +1 for autofill API.
- Tiki 8y agoRough edges in KeePass?
- pdoconnell 8y agoThe need to use a third party plugin to get any form of cloud sync working for one. Minor weirdness with it scrolling through your secret share structure on the left instead of up and down your passwords if you have accidentally clicked over (a feature that acts more like a bug). The lack of ability (or at least any documentation) on how to use something like Google Authenticator as MFA for the database.
- jeena 8y agoThe external sync is a feature for me, not a bug. I can use whatever tool I want to sync between my devices (I use Syncthing) and do not need to trust some company with storing my stuff on their servers and not fiddling with them.
- paulie_a 8y agoIt's UI is outright ugly.
- neilsimp1 8y agoIf this is any good I'll be considering it as a replacemnt for Keepass. A bit off topic, but while looking at this I noticed another expirement - Firefox Side View. It looks like it lets you have two open tabs side-by-side in one browser window. This is exactly why I used the Tile Tabs[0] extension and had to switch to Tile Tabs WE[1] with the Quantum update. I'm happy to see this coming back without the WE workarounds. [0]: https://addons.mozilla.org/en-US/firefox/addon/tile-tabs/ https://addons.mozilla.org/en-US/firefox/addon/tile-tabs/ [1]: https://addons.mozilla.org/en-US/firefox/addon/tile-tabs-we/ https://addons.mozilla.org/en-US/firefox/addon/tile-tabs-we/
- awill 8y agoI use Android, Linux (at home), and Mac (at work). I switched from KeePass because the UI was really bad, it seemed dead, and I really didn't want to move to KeePass 2 (with Mono on Linux). I switched to enpass, and it's been great. It has native Linux/Mac/Windows apps, a solid Android app (with fingerprint support), and there's no subscription. It's perfect for my needs.
- jeena 8y agoThe newest kid on the block is KeePassXC https://keepassxc.org https://keepassxc.org
- bubblethink 8y agoThe browser extension leaves a lot to be desired though. I feel that there are a lot of good standalone password managers, but the ones with good browser extensions are far fewer. I'm using bitwarden right now, which so far seems to be the best of the open source ones in terms of usability.
- jeena 8y agoHm, enpass seems to be closed source which makes it unusable for me to store all my passwords basically because of the same as someone wrote in their forum: "The fact that Enpass isn't submitting all my passwords to enpass.io right now doesn't mean anything. I'm currently using iptables to restrict Enpass from doing so, but I don't know yet how to archive the same thing on my unrooted Android."
- gervase 8y agoFrom the link, it claims that this "gives access to all the logins you've saved in Firefox", but I thought it was common knowledge that in-browser password storage is insecure? [0,1] If so, then this doesn't really promote much confidence in a product that appears to be a password manager. If they've addressed this issue, then that should probably be explicitly stated, although I understand the difficulties of that from a marketing perspective. Maybe the reference to 256-bit encryption is a nod to this, with the expectation that those unfamiliar with the problems wouldn't be familiar with the differences between plain-text and encrypted storage? Regardless, I think it's pretty promising that a browser is addressing this problem head-on, rather than leaving it to third-party companies to solve in a cross-platform way. [0]: https://nakedsecurity.sophos.com/2018/03/20/nine-years-on-firefoxs-master-password-is-still-insecure/ https://nakedsecurity.sophos.com/2018/03/20/nine-years-on-fi... (If you don't use a master password, which isn't required, I believe?) [1]: https://www.wired.com/2016/08/browser-password-manager-probably-isnt-enough/ https://www.wired.com/2016/08/browser-password-manager-proba...
- 0942v8653 8y ago> in-browser password storage is insecure > (If you don't use a master password, which isn't required, I believe?) When using a cloud-synced password vault that lands on the servers of a third party (this includes Firefox, Google, 1Password, Lastpass, etc.) you must always assume that the file itself is compromised; the only thing between an attacker and your passwords is the encryption by your master key. I seriously doubt that Firefox Lockbox will allow you to cloud-sync your password file without setting a master password. * Note: One of the first things malware authors typically go for is the password vault stored in browsers, but this is only because it is commonly used without any master key set. * It might depend on some key derived from your account password, if you haven't observed the requirement of a master key. Not sure.
- zeveb 8y ago> I seriously doubt that Firefox Lockbox will allow you to cloud-sync your password file without setting a master password. The current Firefox Accounts protocol simply encrypts a master key with a key derived from the account password. That's not terrible, although it does mean that account passwords must be cryptographically strong. However, Firefox Accounts can be logged into from a webpage which executes JavaScript served dynamically, which means that Mozilla, a Mozilla employee or any government or organisation which can compel Mozilla or Mozilla employees can serve targeted JavaScript to you to steal your master password, and then silently read your passwords. As such, Firefox accounts cannot be trusted with high-security passwords. (Yes, you have to trust Mozilla to run Firefox at all, but it's significantly easier to hide a single download of a compromised JavaScript file than it is to hide a compromised Firefox binary served to the world)
- ddoolin 8y agoFor me, 1Password has taken care of this space for years, so I'm curious how this will compare.
- trash_panda 8y agoIt could be shipped by default with Firefox, facilitating user adoption. Also, free.
- CodeXs 8y agoI was under the impression that the password manager for Firefox had some security issues.
- mimsee 8y agoThe iOS app seems to be region-locked to U.S. only App Store.
- devinreams 8y agoOnly for now. This is just the beginning of an experimental product and we're hoping to bring it far and wide later. Other than "every", what language or regions would you want/expect/need first?
- jeena 8y agoI hope you are aware of the fact that language and geography most of the time don't match because one person is capable to speak/read multiple languages and that English is understood by people outside of the USA?
- albertgoeswoof 8y agoAll English speaking countries would be a good start for (almost?) zero effort on Mozilla's part.
- jorams 8y agoHonestly, the region shouldn't matter. If you want you could add a little notice that it's English-only for now, but there's absolutely no reason to limit this to a particular country. It's a totally free service and it doesn't involve complicated region-specific licensing agreements, so where someone lives quite simply does not matter.
- _verandaguy 8y agoDoes this have any advantages over an out-of-band system like KeePass/2/X/CX?
- laurent123456 8y agoBrowser integration in Android/iOS?
- sametmax 8y agoSync, integration, simpler UI, portability and better ergonomics. I use both lastpass and keepass, but keepass is really disliked by the non geeks around me.
- vxNsr 8y agoDoes this have safari integration? Will it support iOS 12 auto fill? Most importantly, how likely is this gonna disappear after a year or two like so many other Mozilla side projects?
- LeoNatan25 8y agoMost likely. The iOS guys that work on Mozilla apps are pretty tech savvy and use latest Apple technology.
- vxNsr 8y agoI appreciate the vote of confidence but I was hoping someone from the team could chime in or someone who took the time to try it out. Based on other comments in this thread it looks like it may just rely heavily on copy/paste.
- LeoNatan25 8y agoIt’s not a vote of confidence, it’s my professional opinion as an iOS developer. If push comes to shove, since all Mozilla iOS projects are open source, anyone can add this functionality.
- devinreams 8y agoYes, us guys and gals working on the app are planning on the iOS 12 autofill API integration: https://github.com/mozilla-lockbox/lockbox-ios/issues/445 https://github.com/mozilla-lockbox/lockbox-ios/issues/445
- LeoNatan25 8y agoKeep up the good work! Not surprised you are already considering it.
- adtac 8y agoI think you mean https://github.com/mozilla-lockbox/lockbox-ios/issues/486 https://github.com/mozilla-lockbox/lockbox-ios/issues/486 :)
- dangelov 8y agoIf I'm already using Firefox on Mac, Windows & iPhone, what advantage does this bring over just opening the Firefox app on my iPhone and looking in Settings > Saved logins? Seems to me to be exactly the same, am I missing anything?
- hnra 8y agoEase of use: 1. Don't have to open a browser and slog you way through a settings menu. 2. Native app for iPhone and Android will allow you to auto fill these passwords in apps. 3. Easier management of passwords because you now have a UI with the sole purpose of managing passwords. Also, this doesn't lock you into using Firefox, you can switch to whatever browser you want and still use this for managing passwords. If they release an Android version and improve the browser UX this could be a good alternative to 1Password or LastPass.
- sametmax 8y agoIt's faster. It syncs. It's safer than firefox passwords manager. It unlocks integrates better with the OS (unlock with fingerprints or face). You can use it for something else than websites. However, it's still nowhere as convenient as lastpass. But it's a good first step. I wish them luck.
- larrik 8y agoThe existing app already syncs, though. "Faster" we'll see. Integration is probably the main point.
- owaislone 8y agoI would absolutely love to have this on Android and available worldwide.
- abhiminator 8y agoI'm betting it's in the works already. Edit: Yes, can confirm. It is in the works. [0] [0] https://goo.gl/forms/ZwLIfHSGLrYcM6k83 https://goo.gl/forms/ZwLIfHSGLrYcM6k83 (link from the announcement article)
- deleted 8y ago[deleted]
- bovermyer 8y agoThis is interesting, and I'm looking forward to seeing where it goes. However, it's very unlikely to replace Bitwarden for me.
- lern_too_spel 8y agoThere is a surprising lack of unit tests in Bitwarden, which is mostly maintained by one person. If Mozilla can apply its rigorous engineering practices to maintaining an open source password manager with all the features I use, I will switch from my current system.
- bovermyer 8y agoI'll admit that some of the Bitwarden clients are... less reliable than I would like.
- aaronkjones 8y agoI am curious how it works, technically speaking. I already have this capability with password-store (pass), that works for Firefox, Chrome and Safari on destop and mobile. pass - https://www.passwordstore.org https://www.passwordstore.org (core program) passff - https://github.com/jvenant/passff https://github.com/jvenant/passff (firefox desktop) passforios - https://mssun.github.io/passforios https://mssun.github.io/passforios (ios w/firefox mobile) qtpass - http://qtpass.org http://qtpass.org (osx, linux, windows)
- buddylw 8y agoOpenKeychain and Password-store (paired with a yubikey) is the entire reason I use Android over iOS. I really wish there was hardware GPG key solution for the iphone.
- bhhaskin 8y agoSame and it is fantastic!
- Thriptic 8y agoHas anyone done a thoughtful comparison of PW managers? I moved on from keepass because it was a huge hassle to use, but LastPass and 1password both have some detractors as well.
- walrus01 8y agoI specifically use keepassx and v2 format keepass file db, separately, because it is not integrated with any browser via extension or plugin. Keeping things compartmentalized reduces risk in my opinion. And unless I copy the locally stored .kdbx file somewhere manually, it has zero interaction with any network, cloud based service, or third party beyond my control.
- com2kid 8y agoI was tired of browser plugins that just didn't always work quite right. Keepass, on whatever platform using whatever client, just uses the clipboard. 100% chance of working, although not safe against certain types of spyware.
- zokier 8y ago> Keepass, on whatever platform using whatever client, just uses the clipboard. 100% chance of working, although not safe against certain types of spyware On Android the preferred way of using Keepass is with custom keyboard, which protects against clipboard sniffing.
- GordonS 8y agoIt's not all clipboard based - Keepass has an RPC plugin that can be used with browser extensions for Firefox and Chrome. I also use Keepass2android for (duh) Android, and while you can use copy/paste it also has a custom keyboard you can use instead.
- com2kid 8y agoTrue, there are other options, but the fact that it works really well as a simple list of my passwords is what I like most about it. Between Chrome's cross-platform autofill, Firefox's autofill, and browser plugins, I have too many things telling me what my password should be. s
- hartator 8y agoI wonder if the passwords are encrypted from end-to-end. I am not very confortable having my passwords in plaintext, even on Mozilla servers.
- driminicus 8y agoI haven't looked in to it, as I'm not an ios user, but Mozilla would be very stupid if this isn't end to end encrypted. And as far as I know Mozilla typically isn't stupid.
- hartator 8y ago`will sync to the app using 256-bit encryption` is not very reassuring. It seems to be regular SSL without a master key.
- firefox-lockbox 8y agoYour logins are encrypted end-to-end, with a key that Mozilla's server don't have. You can find more about how sign-in and key management works in https://github.com/mozilla/fxa-auth-server/wiki/onepw-protocol https://github.com/mozilla/fxa-auth-server/wiki/onepw-protoc...
- have_faith 8y agoIs this a Firefox password manager or a general password manager with integration with Firefox? Should I expect to be able to replace 1Password with it for instance. If I can't then I have no motivation to have two password managers. Unrelated, does this page implement it's own custom scrolling? I get some weird rendering bugs when scrolling too, very stuttery.
- GranPC 8y agoIt's a way to access your data stored in Firefox's internal password manager.
- jeena 8y agoI wonder if it also works with the self hosted firefox sync server or if they forgot to add a UI to change the URL to the sync server.
- pietroglyph 8y agoHere's some more in-depth information on the architecture of Lockbox: https://lockbox.firefox.com/architecture/ https://lockbox.firefox.com/architecture/
- motohagiography 8y agoI am a fan of the quality of dev the Firefox team has, and am sure they have thought this through very deeply. For trust and security, it would be helpful if that were reflected in the specs as well as the final product. I was the architect for a solution solving a similar problem some years ago, and then, as apparently now, the key derivation scheme appears to be a bit of a shell game. Was just reading this and trying to get a picture of how someone could reason about trusting it. This doc specifies four symmetric keys, where two are used for encryption, and two are used as salts. The salts are derivations, which are hashes from data elements So simply, we have: FxA credentials: a string or blob to be determined. f: some function tbd k_pre: a bootstrapping scheme initialization key. k_enc: keystore key. k_salt: a user-bound diversification component k_item: a key to encrypt an item within the encrypted container, or "lockbox" Some definitions: k_pre :=(f(FxA)) k_enc := (f(k_pre)) k_salt := KDF(k_pre, userid, infostring, length) item := KDF(k_salt, k_enc) Question is, what is FxA? Best thing could be is an HSM key with a user-bound diversification component, with some kind of secure provisioning protocol to get it into the device, but from what I can tell from the docs, there are still some exercises for the reader. What wasn't clear on first reading from the architecture was the protocol they use between where the lockbox is stored, and where its components are used. When I did this, we used a variation of OCRA to prove possession of correct keys and their versions and release verifications for "items," (attributes). The next useful documentation step would describe a sequence like: A -> B: init msg B -> A: challenge A -> B: (userid, key version, HMAC(k_pre, challenge)) B -> B: derives k_pre(userid)+ HMAC, validates B -> A: challenge' A -> B: etc... Not to be a pedant about this stuff, but to be able to reason about the things we can trust it for, there are some things we can't be handwavy about.
- davidrusu 8y agoI've been working on this distributed offline-first datastore that uses the Git protocol as the network layer. I'm calling it GitDB (but the Git trademark is getting more strictly enforced these days so that'll need to change). The idea is that we should be able to build tools where the user can understand and manage where data is stored while at the same time keeping many of the conveniences of modern apps, like cross-device sync. As a user, you can decide if you trust Github, Gitlab, Bitbucket, etc. and pay them to host your data. The first tool I wanted to build with GitDB was a password manager but seeing this post made me wonder if there would be enough people who wanted this level of control over data, does this sound like something you'd be into? This work is all super early, but would love to gauge the interest from others. If someone wants to help build this thing: https://github.com/the-gitdb-cooperative/gitdb https://github.com/the-gitdb-cooperative/gitdb
- jeena 8y agoI hope it only uses normal git stuff, so that I can selfhost it too on my laptop or on my computer at home as I do with my private git repos?
- davidrusu 8y agoYep, just pure git, it's nothing fancy on that front.
- tlb 8y agoPass (https://www.passwordstore.org/ https://www.passwordstore.org/) uses git as a password database in a similar way.
- davidrusu 8y agoAFAIK pass won't handle conflicts for you (please correct me if I'm wrong!). This isn't a big problem for a password manager since conflicting changes are very uncommon, but for other apps this starts to get more important.
- 8y ago
- bonsai80 8y agoAre Firefox passwords encrypted on the client? I currently use (any pay for) Bitwarden and I like that the code is open and my data is encrypted on the client and only synced with the server. I'd like a similar service from Mozilla, but don't know how the encryption is handled.
- sciurus 8y agoYes, they are encrypted on the client. https://blog.mozilla.org/services/2014/04/30/firefox-syncs-new-security-model/ https://blog.mozilla.org/services/2014/04/30/firefox-syncs-n... https://github.com/mozilla/fxa-auth-server/wiki/onepw-protocol https://github.com/mozilla/fxa-auth-server/wiki/onepw-protoc...
- zokier 8y agoIf you have master password set in the browser then the password db is encrypted locally. I remember there being some noise about it not being very secure encryption, so better check the details if that is critical for you. As for the Firefox Accounts/Sync stuff, afaik MozCo servers see only encrypted content. https://medium.com/mozilla-tech/how-firefox-sync-keeps-your-secrets-if-tls-fails-14420d45885c https://medium.com/mozilla-tech/how-firefox-sync-keeps-your-... might provide more insight
- woodrowbarlow 8y agoas others have said, it's encrypted if you enable the "master password" option; however, the ux of the master password is miserable: * the prompt for entering your master password is a simple dialog, with "ok" and "cancel" buttons. a website could probably trigger an identical prompt with javascript to phish your master password. * the prompt pops up once when you first start the browser (about 15-30 seconds after everything is loaded) and then (if you dismiss it with "cancel") again each time you visit a site for which you have a saved password. there's no way to trigger the unlock prompt on-demand. * the master password doesn't have a timeout. once you've unlocked the keychain, it remains unlocked until you restart the browser. don't bother. stick with whatever third-party extension you're using.
- FullyFunctional 8y agoI installed it and will compare it to Lastpass (which is pretty good IMO). HOWEVER, it saddens me to read on the front page: "using 256-bit encryption". I'd really expect the competent people at Mozilla to know that this statement means next to nothing. At the very minimum I want to know: 1) HOW is the key derived (say, "derived used PBKDF2 on the Firefox username + password") 2) WHERE is it encrypted (I assume "encrypted on the device/end-to-end/zero-knowledge"). It needs to be clear what the attack vectors are. 3) HOW is the secret managed (say, "Secret is wiped on all application switches") and probably more that I forgot. Using the app, the first thing I noticed is that I have a LOT of duplicate entries but no obvious way to clean that up. EDIT: I see most of these details are on https://blog.mozilla.org/services/2014/04/30/firefox-syncs-new-security-model/ https://blog.mozilla.org/services/2014/04/30/firefox-syncs-n... but it doesn't change my disappointment in the totally useless "256-bit encryption" statement. Just say "strong encryption practices" and provide a link to the details. 8,192 bit encryption doesn't help you if you don't manage the key well.
- ChrisSD 8y agoI'd guess for that page the technical details get fed to marketing who boil it down to whatever they think will impress people with limited (if any) technical knowledge.
- FullyFunctional 8y agoExactly that, but shouldn't we expect better from Mozilla?
- Someone1234 8y agoFor Mozilla to be successful they have to appeal to the largest demographic possible. I'd only ask that Mozilla make additional technical information easy to find and well laid out. This is LastPass's page: https://lastpass.com/support.php?cmd=showfaq&id=1096 https://lastpass.com/support.php?cmd=showfaq&id=1096 But that too you won't find when you use the app/extension normally.
- zokier 8y agoOne of the ideas I had once was to build a client for Firefox Sync, either as a plugin for Keepass or as a native standalone application (that could possibly sync with Keepass database). While this does not exactly match such use, it kinda still is a step towards that direction.
- test6554 8y agoIs the firefox lockbox for hot stocks?
- drdaeman 8y agoI'm disappointed. Instead of making password management modular, so any password manager capable of certain queries and operations (KeePass, LastPass, Bitwarden, KWallet/Gnome Keyring/libsecret, Microsoft Credentials Management API, Apple Keychain, etc) could become a storage backend with some programming effort... they're doing the exact opposite - they've created yet another password manager UI and yet another proprietary data format (Lockbox Data Storage) for that purpose. Seriously, I doubt many (if anyone) but Mozilla management needs or wants a Mozilla-branded extra ecosystem, in addition to Google, Apple and Microsoft-branded ones - yet another piece of software that doesn't interoperate with anything but its own unique data formats and protocols. I don't know what others want, but I want a good browser that I can hook up with things I already use.
- rainbowmverse 8y agoWe either have different definitions of proprietary, or I'm misunderstanding something. The format appears to be open and documented. https://github.com/mozilla-lockbox/lockbox-datastore https://github.com/mozilla-lockbox/lockbox-datastore
- drdaeman 8y agoDifferent definitions, I guess. I call it proprietary because it's: - Unique to Mozilla products. Invented there (disregarding any existing solutions of the same problem) and no one else uses this. - Based on Accounts and Sync I believe this is not a standard at all, just something that happens to be documented. With FxA&Sync there are a lot of undocumented subtleties and things sometimes change at whim without any warnings. If you make an independent implementation, you're bound to be always catching up, just like it is with any other proprietary protocols. It's "open" because it's documented and the implementation is FLOSS, but it's also "proprietary" because effectively, Mozilla is in full and ultimate control of this stuff.
- annabellish 8y agoThey are on day one, sure, but if the file format is documented and clear then there's no reason why other managers couldn't interoperate. It's not as good as using an existing standard, but I'm not sure there is _an_ existing standard right now.
- rainbowmverse 8y agoCan't believe they didn't call it Lockfox.
- devinreams 8y agoFirebox Lockfox? Firelock Boxfox? Lockfire Foxbox? Ugh, we tried them all, I swear..
- rainbowmverse 8y agoJust plain old Lockfox. However, I understand you probably have some branding/marketing/PR concerns to keep in mind with naming.
- gkya 8y agoLockfox sounds like something that breaks or works around locks to me, fox being a sneacky tricky animal; not really reassuring.
- rainbowmverse 8y ago>> "fox being a sneacky tricky animal" Foxes are good and pure creatures.
- gkya 8y agoBut it has certain connotations in many cultures, which is not positive. I too like them and know they aren't a part of our value system, but naming a security product that is meant to protect your valuable stuff "fox" is like calling a bank Robbers&co.
- rainbowmverse 8y agoThat was humor. I'm aware of the centuries of anti-fox propaganda.
- bryanrasmussen 8y agoI am considering this but worry that mozilla has a history of shutting down initiatives and products.
- bscphil 8y agoA history of shutting down site-identity related products, no less. [1] The fact that it's not on Android as of day one looks pretty bad too; the sort of developers who think iOS obviously comes first are (in my experience) likely to be chasing hype and their apps are dead in a year (or at least still not on Android). I don't know if that's the case here, but I have no interest in using this until it's been adopted by Mozilla as more than an experiment and has several years of strong support. [1] https://developer.mozilla.org/en-US/docs/Archive/Mozilla/Persona https://developer.mozilla.org/en-US/docs/Archive/Mozilla/Per... (I admit I'm biased here but I'm still bitter about them nixing Persona.)
- tekism 8y ago"Test Pilot", "Experiment" are not words I want to see when it comes to my login credentials.
- gkya 8y agoEverything starts out so, so we can wait until it's stable, no?
- breakingcups 8y agoThen you are not the target audience yet.
- nkkollaw 8y agoWhy not integrate it with the mobile browser like Chrome does on Android? Am I missing something?
- firefox-lockbox 8y agoFirefox on iOS provides an integrated experience for logins and filling those logins into browser forms automatically. The team is currently working on autofill from Lockbox into other apps: https://github.com/mozilla-lockbox/lockbox-ios/issues/486 https://github.com/mozilla-lockbox/lockbox-ios/issues/486. This will only be available in iOS12 when that ships. Are there other kinds of integration you see as valuable?
- tlavoie 8y agoNice, will check it out! FF is already my default browser. One question though, is there a good way to import from other exported sources such as LastPass or KeepassXC?
- deleted 8y ago[deleted]
- known 8y agoIt's easy if Firefox directly activates Sync instead of sending a Confirmation link to registered email a/c
- vl-y 8y agoI'd like they go with TypeScript rather than just pure JavaScript.
- czei002 8y agoOn problem with password managers (that are using web authentication to create/manage an account for backing up the password manager in the cloud) is that the authentication password can be leaked during the authentication process. For example, the storage provider for password manager backup can simply read the password from the authentication web page since this web page is hosted at the provider. This is problematic if the authentication password is also used to encrypt the password manager, i.e. the provider could decrypt the password manager with the authentication password. You would actually need two passwords; one for authentication and one for encryption. Unfortunately, you usually don't even have the option to choose two passwords. To solve this problem I'm working on FejoaAuth (https://fejoa.org/fejoapage/auth.html https://fejoa.org/fejoapage/auth.html). FejoaAuth uses an authentication protocol that does not leak the user password to the provider who is going to store the password manager. This protocol is run in a trusted browser plugin in order to ensure the correct execution of the protocol. Thus you can use a single password for authentication and password manager encryption.
- wemdyjreichert 8y agoInsert Al Gore joke here