4 ms·
Yes, sort of (more about the process: https://github.com/mozilla/fxa-auth-server/wiki/onepw-protocol#changing-the-password https://github.com/mozilla/fxa-auth-s
by yoklov 8y ago
Yes, sort of (more about the process: https://github.com/mozilla/fxa-auth-server/wiki/onepw-protocol#changing-the-password https://github.com/mozilla/fxa-auth-server/wiki/onepw-protoc...). Key difference: you don't need to sync all the data up again, since there's a separate key for that, which doesn't change.
That said, if you forget your password you do lose remote synced data. The hope is that you have at least one device connected that still has the data, which will upload it in that case. This doesn't work in all cases (there's a pretty common and unfortunate pattern where someone reinstalls their OS, doesn't remember their password, and loses data as a result)
You can also generate and store a separate recovery key to help avoid data loss, https://support.mozilla.org/en-US/kb/reset-your-firefox-account-password-recovery-keys https://support.mozilla.org/en-US/kb/reset-your-firefox-acco....
- adobeeee 8y agoYou seem to know a bit about encryption. Which is why it baffles me- how does telegram do this? Does it need a connected device in this way too? So one can upload the encryption key if its lost? If no device is connected, can/how do they do it? If yes, can Firefox copy that way?
- ryukafalz 8y agoTelegram chats by default are not end-to-end encrypted. It does have e2e-encrypted chats as an option, but they're only accessible on one device. So: >how does telegram do this? ...the short answer is they don't.
- adobeeee 8y agoI was referring to them saving encrypted data on their servers. Isn't that e2e encrypted? If not, does that mean an adversary with access to their database knows my chats?
- ryukafalz 8y agoThat is not end-to-end encrypted, no. The company has all the information necessary to retrieve your plaintext conversation data. They can (and likely do) encrypt this data at rest within their infrastructure, and they can make it as hard as they want for an individual employee to access this information, but fundamentally you're trusting that their internal controls are sufficient.
- owaislone 8y agoThanks. I've been using Firefox Sync ever since it came out but I don't remember it ever mentioning these risks. I think Firefox should mention this when new users enable sync for the first time. It should also offer users to generate recovery keys when they start using sync and for some time after if they haven't.
- yoklov 8y agoThere's no risk to your data. It's not like this will delete your local data, the only risk is when doing a password reset in some (fairly rare) cases, which does attempt to make the risk of doing so clear. I don't disagree about recovery keys, they're rather new though, eventually it wouldn't surprise me if we did something like that.
- owaislone 8y agoAh, so local data is not encrypted. It's only encrypted before packets are sent to the servers?
- yoklov 8y agoYes, for the most part. For passwords the story is a bit more complex (they're encrypted locally on all platforms, either with your master password (Desktop, probably Android but I don't remember), or a random key stored in the OS storage for iOS), But we don't use the sync key to encrypt local data ever; many users never set up sync, and have no sync key
- aiiane 8y agoThere is a risk if you were relying on sync to be a backup solution (which in the absence of discussing the risk of remote data loss, someone might be tempted to do).
- yoklov 8y agoSure, and we do warn during password reset. I’m unsure of what alternative there is that avoids that risk while still providing the current privacy benefits.