4 ms·

Happened to me about a week ago. When I opened the browser, a notification popped up telling me "Your bookmarks are now being synced". There was an option to tu

Happened to me about a week ago. When I opened the browser, a notification popped up telling me "Your bookmarks are now being synced". There was an option to turn this off, which I did, but I have to assume that the bookmarks were already sent off to Microsoft. There's nothing remarkable in my bookmarks. I've never really found it to be a useful tool beyond a way of marking things I want to check out again soon. I don't use it for day to day links. I do recall going through this with Chrome and Firefox in the past when they pushed syncing as a huge wonderful benefit for me and I had no interest at all. I'm sure some people have bookmarks as part of their personal workflow and are grateful to have this syncing ability for multiple devices. That's great for them but all vendors need a very strick opt-in policy, not a "we're so sure you're going to love this that we turned it on for you" scheme.

paulryanrogers 5y ago
Firefox doesn't sync by default. And they don't appear to be promoting me to do it on new installs.
- CogitoCogito 5y ago
  Doesn't Firefox sync send off the data encrypted with your password (unknown to them) anyway? This is my understanding. I don't think Firefox can make use of the bookmarks synced to them at all.
  - paulryanrogers 5y ago
    I believe that's how Weave worked. The newer Firefox Sync included (still includes?) sharing capabilities that call that into question.
    - CogitoCogito 5y ago
      > I believe that's how Weave worked. The newer Firefox Sync included (still includes?) sharing capabilities that call that into question. A quick search online makes it seem like Mozilla still has no ability to read what you sync. E.g. from https://en.wikipedia.org/wiki/Firefox_Sync https://en.wikipedia.org/wiki/Firefox_Sync you see: > It keeps user data on Mozilla servers, but according to Mozilla the data is encrypted in such a way that no third party, not even Mozilla, can access user information. It is also possible for the user to host their own Firefox Sync servers, or indeed, for any entity to do so. I can't find independent verifications, but I would trust Mozilla about this at this point. But I'm not sure what sharing capabilities you refer to so I can't really speak to that.
      - paulryanrogers 5y ago
        In hindsight looks like I misunderstood the reason behind this new derived key system [0]. Looks like it was more about not losing access than sharing. [0] https://blog.mozilla.org/services/2014/02/07/a-better-firefox-sync/ https://blog.mozilla.org/services/2014/02/07/a-better-firefo...
CogitoCogito 5y ago
https://docs.microsoft.com/en-us/microsoft-edge/privacy-whitepaper/#sync https://docs.microsoft.com/en-us/microsoft-edge/privacy-whit... > All synced data is encrypted in transit over HTTPS when transferred between the browser and Microsoft servers. The synced data is also stored in an encrypted state in Microsoft servers. Sensitive data types such as addresses and passwords are further encrypted on the device before being synced. That's pretty flowery language for "basically all your data is readable by us". It's pretty ridiculous they would do this without an explicit opt-in.
- MonaroVXR 5y ago
  But everything is encrypted on your device itself, so I could imagine they could grab those bookmarks if they don't encrypt. Google and Firedox do it for their passwords, I'm not sure about bookmarks.
  - CogitoCogito 5y ago
    Yeah as far as I know Firefox sync encrypts everything with your own private key on your device. So Mozilla wouldn't have any access to your bookmarks or other stuff that you sync. I don't know anything about how Chrome's syncing works.
  - coffeeling 5y ago
    What the above says is: Your data is encrypted on your device before being sent to MS. MS knows the key Once received, MS decrypts your data, does whatever serverside things it wants to on your data (OCR, NSA, search indexing), and then re-encrypts it with a key only they know. Protects your data from unauthorized rogues within Microsoft and random attackers, but not from Microsoft betraying your trust. If you ask for your data, they decrypt it with their storage keys, re-encrypt it with their transfer keys (which you can decrypt) to guard against middlemen. You receive the data, you decrypt it. The model is secure, in that it's resilient against attackers, but requires you to trust the provider to be trustworthy and uncompromised. That model is much better than some indie apps, which do encrypt your data between your machine and their server and the reverse, but store your data at rest on their server in a plain, unencrypted format. This means attackers and rogue employees have an easier time getting to your data. True end-to-end or zero knowledge encryption encrypts the data on your device, and the provider's server only ever sees encrypted nonsense, they don't have the keys to undo the decryption even if they wanted to (thus the name zero knowledge). Your data is only decrypted on your device locally. Edge stores passwords and some other data end to end encrypted, as far as I know, but only some data types. You can't make everything zero knowledge if you tried to. As far as I know, Chrome doesn't do zero knowledge by default, but can be set up to do it. Firefox, Brave and Vivaldi all run their own sync services and all are (as far as I know) zero knowledge setups.

paulryanrogers 5y ago

Firefox doesn't sync by default. And they don't appear to be promoting me to do it on new installs.

CogitoCogito 5y ago
Doesn't Firefox sync send off the data encrypted with your password (unknown to them) anyway? This is my understanding. I don't think Firefox can make use of the bookmarks synced to them at all.
- paulryanrogers 5y ago
  I believe that's how Weave worked. The newer Firefox Sync included (still includes?) sharing capabilities that call that into question.
  - CogitoCogito 5y ago
    > I believe that's how Weave worked. The newer Firefox Sync included (still includes?) sharing capabilities that call that into question. A quick search online makes it seem like Mozilla still has no ability to read what you sync. E.g. from https://en.wikipedia.org/wiki/Firefox_Sync https://en.wikipedia.org/wiki/Firefox_Sync you see: > It keeps user data on Mozilla servers, but according to Mozilla the data is encrypted in such a way that no third party, not even Mozilla, can access user information. It is also possible for the user to host their own Firefox Sync servers, or indeed, for any entity to do so. I can't find independent verifications, but I would trust Mozilla about this at this point. But I'm not sure what sharing capabilities you refer to so I can't really speak to that.
    - paulryanrogers 5y ago
      In hindsight looks like I misunderstood the reason behind this new derived key system [0]. Looks like it was more about not losing access than sharing. [0] https://blog.mozilla.org/services/2014/02/07/a-better-firefox-sync/ https://blog.mozilla.org/services/2014/02/07/a-better-firefo...

CogitoCogito 5y ago

https://docs.microsoft.com/en-us/microsoft-edge/privacy-whitepaper/#sync https://docs.microsoft.com/en-us/microsoft-edge/privacy-whit... > All synced data is encrypted in transit over HTTPS when transferred between the browser and Microsoft servers. The synced data is also stored in an encrypted state in Microsoft servers. Sensitive data types such as addresses and passwords are further encrypted on the device before being synced. That's pretty flowery language for "basically all your data is readable by us". It's pretty ridiculous they would do this without an explicit opt-in.

MonaroVXR 5y ago
But everything is encrypted on your device itself, so I could imagine they could grab those bookmarks if they don't encrypt. Google and Firedox do it for their passwords, I'm not sure about bookmarks.
- CogitoCogito 5y ago
  Yeah as far as I know Firefox sync encrypts everything with your own private key on your device. So Mozilla wouldn't have any access to your bookmarks or other stuff that you sync. I don't know anything about how Chrome's syncing works.
- coffeeling 5y ago
  What the above says is: Your data is encrypted on your device before being sent to MS. MS knows the key Once received, MS decrypts your data, does whatever serverside things it wants to on your data (OCR, NSA, search indexing), and then re-encrypts it with a key only they know. Protects your data from unauthorized rogues within Microsoft and random attackers, but not from Microsoft betraying your trust. If you ask for your data, they decrypt it with their storage keys, re-encrypt it with their transfer keys (which you can decrypt) to guard against middlemen. You receive the data, you decrypt it. The model is secure, in that it's resilient against attackers, but requires you to trust the provider to be trustworthy and uncompromised. That model is much better than some indie apps, which do encrypt your data between your machine and their server and the reverse, but store your data at rest on their server in a plain, unencrypted format. This means attackers and rogue employees have an easier time getting to your data. True end-to-end or zero knowledge encryption encrypts the data on your device, and the provider's server only ever sees encrypted nonsense, they don't have the keys to undo the decryption even if they wanted to (thus the name zero knowledge). Your data is only decrypted on your device locally. Edge stores passwords and some other data end to end encrypted, as far as I know, but only some data types. You can't make everything zero knowledge if you tried to. As far as I know, Chrome doesn't do zero knowledge by default, but can be set up to do it. Firefox, Brave and Vivaldi all run their own sync services and all are (as far as I know) zero knowledge setups.