3 ms·
> The party which holds your data is also the party which ships evergreen versions of the software used to decrypt that data. There’s nothing to stop the govern
by arkadiyt 4y ago
> The party which holds your data is also the party which ships evergreen versions of the software used to decrypt that data. There’s nothing to stop the government in Firefox’s jurisdiction from bullying them into adding a backdoor.
Hosting your own sync server doesn't prevent this.
- tinus_hn 4y agoThe government can’t bully you into decrypting your own data or releasing your encrypted data without you knowing.
- robjan 4y agoIf Firefox is backdoored, as per GP's hypothetical situation, your data can be sent to a sync server other than the one you configured. The only realistic way to stop it would be to only use a specific audited version of FF. If that's the case then there's no need to use your own sync server because you already know it's not backdoored.
- robin_reala 4y agoWhich government? Because there absolutely are governments that can, UK for example.
- tinus_hn 4y agoThe UK government can bully you into telling them things without you knowing you told them those things? That sounds interesting, how does that work?
- robin_reala 4y agoOops, misread the “without you knowing” bit.
- mrmanner 4y agoThey can bully the open sourcerer into adding a backdoor to the code, then use that backdoor without you noticing.
- tinus_hn 4y agoThere can be no guarantee you’d not notice, but more importantly if you go down that path you can’t trust anything and that is a silly reason to not build defense in depth and not entrust your secrets to the cloud.