8 ms·
Firefox Lockbox – Take your passwords everywhere
- wyxuan 8y agoI think it is great that Firefox is branching out of just browsers, and making its own ecosystem of products. However, it doesn't seem that necessary. The existing field is already pretty good imo.
- nathan_long 8y agoI think password management is a good fit for Mozilla. I perceive Mozilla to be trustworthy and competent, and the code for this is open source: https://github.com/mozilla-lockbox https://github.com/mozilla-lockbox They also generally do a good job with UI, which is not true of all open source solutions. This may not be crucial for devs, but it's crucial if we want to share passwords with the non-devs in our lives.
- JoelMcCracken 8y agoThe main ones I know of are all closed source. Some may not quite be (bitkeeper?) but as far as user controlled pw management goes I think the market is far from saturated
- emerongi 8y agoIt's nice to see clear information on the metrics collected: https://github.com/mozilla-lockbox/lockbox-android/blob/master/docs/metrics.md https://github.com/mozilla-lockbox/lockbox-android/blob/mast... As long as it's clearly and openly communicated what telemetry is collected, I'm fine with an app collecting whatever information they want: I get to make the decision on whether I give up that information by (not) installing the app.
- saagarjha 8y agoIs it opt-in?
- nichos 8y agoThere's an option to opt in, at least on the Android app in the settings.
- 15characterslon 8y agoSeems to be opt-out, at least it was enabled for me by default on Android. :/
- StavrosK 8y agoThis is very nice, especially since I use Firefox as my second password manager (I enabled "save passwords" because it's so handy). All it needs is better management and the ability to store more data in the DB, and I'm sold! OATH would be nice too.
- OJFord 8y agoThis is great, I use `about:logins` on Android FF when I need this; I'll gladly use this instead.
- amelius 8y agoDoesn't Firefox "Sync" (a standard feature) already solve this more or less?
- callahad 8y agoLockbox is effectively a client for Sync which is decoupled from Firefox itself. This means, for example, even if you browse with Chrome on Android, you can still access and auto-fill all of the passwords you have saved in your desktop Firefox.
- bastawhiz 8y agoI think this is wonderful, but I have two concerns. First, if there isn't a Chrome plugin, it's not going to be of much use to me. I still use Chrome on my laptop (for a multitude of reasons) and if Lockbox doesn't interoperate with it, it's not a useful tool. Second, I worry about the longetivity of the project. Other than Firefox, Mozilla is not known for their long-term support of consumer products. Persona? Firefox OS? Thunderbird? I don't want to switch to a product that's only going to be retired in a year.
- piotrkubisa 8y agoIsn't that what are you looking for https://github.com/mozilla-lockbox/lockbox-addon https://github.com/mozilla-lockbox/lockbox-addon?
- saagarjha 8y agoFirefox makes a desktop browser, though. Why should they provide a Chrome extension?
- jjuel 8y agoThey make a mobile browser too so why make this app?
- bastawhiz 8y agoBecause I could just as easily use a competing product that does work with Chrome. An all-or-nothing mentality with (free consumer) software isn't a great way to acquire new users. Switching my primary browser to use a password manager that I like is a ridiculous decision.
- fgonzag 8y agoThis is a password manager for people who already have their passwords on Firefox... so I don't really think you're the target market here. It basically allows you to use your FF passwords in your local apps
- chachan 8y ago
- deleted 8y ago[deleted]
- rmist 8y agoRequires Android 7.0 and up :(
- netforay 8y agoWonderful, have been waiting for this for a long time. At one point I thought of developing my self. But 43mb for password sync app?? Is it not too much?
- xnyan 8y agoNot an explanation or saying its right or wrong, just a comment - anything under 100mb (on my personal computer or smartphone) to me is small enough as to be statistically insignificant in my mental model. I saw 43mb and thought it was kind of slim. Born in '88 for context, the smallest primary storage device I can remember using was a 20mb HDD on a hand-me-down 486 I got one birthday.
- StevePerkins 8y agoAwfully buggy. Just installed on Android. After syncing to my account it shows "no entries found", even though I have hundreds of saved logins in my Mozilla account. Tried disconnecting my account in order to re-add it again, and can't find a way to do the latter. It just keeps showing the "Disconnect Firefox Lockbox" button, even though it (presumably) is already disconnected. Will check back in a couple of months to see if it's more fully-baked. But right now this feels pretty pre-alpha.
- firefox-lockbox 8y agoThis is great feedback. We are currently working on improvements on this specific finding. We'll continue to provide updates to make Firefox Lockbox a better experience. Thanks for trying and testing the app.
- ktm5j 8y agoCan I make the suggestion of implementing folders or categories of some kind? That's a big feature that I care about that seems to be missing. And having the ability to create/edit entries from the phone app would be great Regardless of those issues I think the app looks great! Thanks for your efforts
- AJRF 8y agoI'm on the Android Q beta and trying to open the sign in link LockBox send's you causes Firefox to crash over and over it look's like.
- Sebguer 8y agoA lot of things are broken in the Android Q beta, to be fair.
- solarkraft 8y agoNeat, how does it compare to Bitwarden? Is it decoupled enough from the browser itself?
- giancarlostoro 8y agoSo whats different from Firefox Sync which already just works for centuries now?
- Tomte 8y agoYou don't need Firefox. It's a stand-alone app.
- giancarlostoro 8y agoApparently you still need a Firefox account though. I can appreciate it being stand alone I guess. It is a little too late for me now that I have Bitwarden though.
- deleted 8y ago[deleted]
- chuckgreenman 8y agoI like this move into more consumer type applications from Mozilla. I'd be interested to see some of their newer stuff moving to a subscription model that supports Mozilla, I know you can make recurring donations but it seems like people are more interested in buying a product that supports the organization making it.
- philips 8y agoThere is also a Notes app. https://blog.mozilla.org/blog/2018/07/10/introducing-firefoxs-first-mobile-test-pilot-experiments-lockbox-and-notes/ https://blog.mozilla.org/blog/2018/07/10/introducing-firefox...
- SubiculumCode 8y agoThe problem with firefox sync is that my search history and bookmarks are synced...which is non optimal when jumping between work and home computers. I use lastpass to sync my passwords..but would consider alternatives...lastpass performance has degraded lately.
- darkwinx 8y agoYou can choose what to sync.
- SubiculumCode 8y agoThanks! It lists logins as an option. Does this sync sessions of just credentials?
- CtrlAltT5wpm 8y agoI'm in the same boat you are. I'm considering alternatives to Lastpass, mostly because the client has gotten worse over the past few years (since they were picked up by LogMeIn). I don't mind price hikes, but I don't feel as if I've gotten a commensurate increase in the utility or smoothness of the application (though I've certainly noticed an uptick in bugs). My big thing is the integration of the Yubikey, which is almost mandatory. Bitwarden has this, but their recent security assessment had a showstopper, as far as I'm, concerned: 'BWN-01-010 – Changing the master password does not change encryption keys' https://cdn.bitwarden.net/misc/Bitwarden%20Security%20Assessment%20Report.pdf https://cdn.bitwarden.net/misc/Bitwarden%20Security%20Assess... If Bitwarden gets that fixed, I'd jump ship instantly. Otherwise, I may play with Firefox Lockbox and see where that gets me.
- xxkylexx 8y ago> Resolution > An option to rotate the encryption key and mac key has been added to the change password operation. Rotating the keys will generate new, random key values and re-encrypt all vault data with these new keys.
- 8y ago
- lousken 8y agoAny advantages compared to Keepass2Android?
- zymhan 8y agoI love having a better front end for my Firefox passwords.
- philips 8y agoWhat is the state of the art for building privacy conscious backends for applications like this? I really haven't seen a great platform that provides well documented and reasonably designed general purpose APIs for handling both encryption, sync, versioning, and conflict resolution. Textile: https://github.com/textileio/go-textile https://github.com/textileio/go-textile Based on IPFS so seems like your entire privacy rests in crypto Bitwarden: https://github.com/bitwarden/server/blob/master/README.md https://github.com/bitwarden/server/blob/master/README.md App works well but it doesn't seem like there is interest in making this general purpose, maybe because of the software stack choice? Standard files: https://standardfile.org/ https://standardfile.org/ Standard notes clobbers data if two devices make offline edits :(
- mintplant 8y ago> What is the state of the art for building privacy conscious backends for applications like this? This has actually become a core competency of Mozilla thanks to the infrastructure laid out for Firefox, which I think will be leveraged in their product strategy going forward.
- philips 8y agoDo you know where the code and design docs are for the backends? The wiki has so many out of date pointers.
- jpeeler 8y agoThere are several alternate implementations for the bitwarden server. Unless my plans change, eventually I plan on deploying this one: https://github.com/dani-garcia/bitwarden_rs https://github.com/dani-garcia/bitwarden_rs
- azdle 8y agoIf there's anyone here who is working on this: Is anyone working on making this available through F-Droid?
- notatoad 8y agoAm i missing something, or is this landing page really nothing more than a screenshot and an app button? I know minimal pages are trendy, but that seems like taking it a bit too far.
- philips 8y agoAnnouncement blog from last year https://blog.mozilla.org/blog/2018/07/10/introducing-firefoxs-first-mobile-test-pilot-experiments-lockbox-and-notes/ https://blog.mozilla.org/blog/2018/07/10/introducing-firefox...
- dgudkov 8y agohttps://lockbox.firefox.com/faq.html https://lockbox.firefox.com/faq.html
- deleted 8y ago[deleted]
- jolmg 8y agoThere are small, gray links at the bottom to a FAQs page and a GitHub account with the corresponding code.
- cbhl 8y agoIt's not at all clear that FAQ link is tied to Lockbox; I usually associate small gray links at the bottom to be domain-wide boilerplate (privacy policies, getting a phone number to call support, etc). I would have expected visiting from desktop web to tell me what the desktop counterpart to this mobile app is (probably either a call-to-action to install Firefox to use with this companion app, or a call-to-action to create a Firefox Sync account to store my passwords). I'm not going to type my hundreds of passwords from scratch using my iPhone keyboard; I'm going to want to import them from LastPass / Firefox / Chrome / Safari / Edge / 1Password / Bitwarden.
- floatingatoll 8y agohttps://blog.mozilla.org/blog/2019/03/26/firefox-lockbox-now-on-android-keeping-your-passwords-safe/ https://blog.mozilla.org/blog/2019/03/26/firefox-lockbox-now... showed up on HN today, which may provide some context (or not).
- scotu 8y agohow does the sync/conflic resolution work? (I'm aware it's firefox long standing "sync" product) are there some docs? I've been burned by dropbox synced keepass password management before...
- pornel 8y agoWorks well on iOS. Integrates as a system-wide auto-fill option, so it works even in native apps. Real Firefox is forbidden from being in the Apple AppStore, and only AppStore apps are allowed to sync with the iCloud keychain, so this is the next best alternative permissible in Apple's garden.
- alimbada 8y agoFirefox is also in the App Store, albeit "real" is a subjective term here since it's forced to use WebKit/WebView (as are all browsers on iOS) if that is what you were alluding to.
- newscracker 8y agoI’ve waited quite sometime for this to be released on Android so that it can be recommended to others. This is great news! But there are a few more features that are necessary to make this truly standalone (these comments are based on the iOS version): - ability to create a Firefox sync account from this app. - ability to add entries in this app and manage them. - ability to import credentials from other applications (like 1Password, BitWarden, Lastpass, etc.).
- kamarg 8y agoPlease let me import from another password manager! There's just too much friction involved in switching if I have to manually import all my existing passwords. And if I can't import them, then I have to keep my old password manager around until I'm sure that I've imported all my old logins by visiting all the sites in case the reset password email is linked to an address I no longer have access to. If I have to do that, there's no point in me switching because I'll never actually be sure I've got all the logins moved over.
- ripdog 8y agoDoes this have a value proposition over a standalone manager like Bitwarden? Saying this as an avowed firefox user and fan. I long ago abandoned browser password managers due to awful security practices like storing passwords in plaintext in my browser profile. Bitwarden is full of features and works everywhere, too.
- deleted 8y ago[deleted]
- zamalek 8y agoIt's Mozilla, so they should be more trustworthy with your data. That being said, I agree with your critique. I am a 1Password customer and enjoy the fact that there are two passwords for my account (rendering keyloggers worthless).
- ksynwa 8y agoI use Pass[0] with GnuPG and a private git repository for storing encrypted passwords. There is an Android client for it on F-Droid. It is a bit of work to bootstrap it but I like it a lot. [0]: https://www.passwordstore.org/ https://www.passwordstore.org/
- 15characterslon 8y agoIt would be nice if it would support custom sync servers. I'm using a custom sync server with Firefox and therefore Lockbox does does not show any of my passwords after login.
- antback 8y agoFeature request: It would be nice to allow adding entries by hand. There are sites that avoid at all cost to let browsers to remember passwords.