4 ms·

Which account, as I've documented before, is insecure; you should not have a Firefox account and should not store passwords, browsing history, bookmarks or any

by zeveb 8y ago

Which account, as I've documented before, is insecure; you should not have a Firefox account and should not store passwords, browsing history, bookmarks or any other privacy- or security-related data with Mozilla's system. (short version: Mozilla can target you with a small piece of JavaScript to steal your password, then use it offline to decrypt your data)

muxator 8y ago
I remember tour comment at the time, but cannot find it right now. Do we know if Mozilla is planning anything to fix this?
- zeveb 8y ago
  > Do we know if Mozilla is planning anything to fix this? Nope, so far as I can tell they are invested in their current approach. In fairness, I will admit that it trades security in order to get a slight improvement in usability. If they'd just make it impossible to log in via JavaScript, and only through the browser UI, then they could increase the security. But they won't do it.
gruez 8y ago
source/explanation?
- zeveb 8y ago
  Firefox Accounts encrypt user data with (a function of) a master key; that master key is encrypted with a key derived from the user's Firefox Account password. It would be completely insecure for Mozilla to know the user's password (because then they would be able to use the password to decrypt the master key & the master key to decrypt each private datum), so they have set up a protocol in which the user enters his password in his browser, and the browser performs some one-way operations on the password to authenticate. Sounds secure, right? The problem is that this happens in JavaScript which is downloaded from Mozilla's site. It would be trivial for Mozilla to target a single user with a piece of JavaScript which boils down to: if (username === 'target') { sendPlaintextPassword(); } The solution is for user login to be impossible through web pages, and only available via the browser UI. This would mean third parties would have the opportunity to audit the Firefox source code (e.g. Debian, Red Hat and other distros could check to see if the source they build is malicious). It would also mean that silently targetting a single user would be far less possible (they could still try to send that user a malicious browser if he automatically installs updates — but a security-conscious user gets his updates from a distro, not from Mozilla directly). It's a really nasty flaw, and the fact that they refuse to address it worries me: why don't they care about the security of their users? Why do they insist on maintaining a backdoor?
  - gruez 8y ago
    >why don't they care about the security of their users? Why do they insist on maintaining a backdoor? did you report this to them? if there was a bug report and they marked it as WONTFIX or something that would give more credence to your theory. otherwise, Hanlon's razor.

by zeveb 8y ago

muxator 8y ago

I remember tour comment at the time, but cannot find it right now. Do we know if Mozilla is planning anything to fix this?

zeveb 8y ago
> Do we know if Mozilla is planning anything to fix this? Nope, so far as I can tell they are invested in their current approach. In fairness, I will admit that it trades security in order to get a slight improvement in usability. If they'd just make it impossible to log in via JavaScript, and only through the browser UI, then they could increase the security. But they won't do it.

gruez 8y ago

source/explanation?

zeveb 8y ago
Firefox Accounts encrypt user data with (a function of) a master key; that master key is encrypted with a key derived from the user's Firefox Account password. It would be completely insecure for Mozilla to know the user's password (because then they would be able to use the password to decrypt the master key & the master key to decrypt each private datum), so they have set up a protocol in which the user enters his password in his browser, and the browser performs some one-way operations on the password to authenticate. Sounds secure, right? The problem is that this happens in JavaScript which is downloaded from Mozilla's site. It would be trivial for Mozilla to target a single user with a piece of JavaScript which boils down to: if (username === 'target') { sendPlaintextPassword(); } The solution is for user login to be impossible through web pages, and only available via the browser UI. This would mean third parties would have the opportunity to audit the Firefox source code (e.g. Debian, Red Hat and other distros could check to see if the source they build is malicious). It would also mean that silently targetting a single user would be far less possible (they could still try to send that user a malicious browser if he automatically installs updates — but a security-conscious user gets his updates from a distro, not from Mozilla directly). It's a really nasty flaw, and the fact that they refuse to address it worries me: why don't they care about the security of their users? Why do they insist on maintaining a backdoor?
- gruez 8y ago
  >why don't they care about the security of their users? Why do they insist on maintaining a backdoor? did you report this to them? if there was a bug report and they marked it as WONTFIX or something that would give more credence to your theory. otherwise, Hanlon's razor.