3 ms·
Sadly, the sync functionality is gated behind an insecure authentication system, so one really shouldn't use it. This is a pity, because Chrome's sync is even
by zeveb 8y ago
Sadly, the sync functionality is gated behind an insecure authentication system, so one really shouldn't use it. This is a pity, because Chrome's sync is even less secure.
Compounding the pity, Firefox used to have a more secure auth system, which they threw away. I'm still appalled by that.
- Steltek 8y agoWhile I really liked the old sync system, it was never going to be user-friendly because it entrusted key management/safety to users. People just aren't ready for that and Mozilla maintaining two systems would compound the user issues. I would accept running my own server for Sync as a solution and I believe this was even possible with the old system? Then power users could have that extra layer of security if they desired but regular users don't have to worry so much.
- zeveb 8y agoIf they would simply get rid of all HTML submissions pages where users may enter their passwords, then the system would probably acceptable. If the Firefox Account UI were entirely browser-managed, it'd be okay. I'd still prefer a system in which it's impossible for users to accidentally leak their secure data through use of a poor password, but that's life. As an aside, I don't see that user key management was really an issue. The UI of the old system was perfectly fine, and one could have added a QR code or similar if one really wanted to. The number of folks doing TOTP auth these days prove that it works. There's only one reason to use dynamically-downloaded JavaScript to ensure user privacy: because one wishes to silently and undetectably undermine user privacy at some point in the future.