3 ms·

What is gained from self hosting the container? Are you able to sync more data than Firefox's official Sync service? Less reliance on a third party service? Wou

What is gained from self hosting the container? Are you able to sync more data than Firefox's official Sync service? Less reliance on a third party service? Would love to understand the value-add. Their docs[0] make it seem like little would be gained from a privacy/security perspective as it seems pretty secure/private (at least to me). [0] https://support.mozilla.org/en-US/kb/how-firefox-sync-keeps-your-data-safe-even-if-tls-fails https://support.mozilla.org/en-US/kb/how-firefox-sync-keeps-...

eqvinox 4y ago
You could put your self-hosted container in a self-hosted VPN to add a layer of protection. But honestly, while encryption theoretically can make any data "safe" to hand to a 3rd party, it's just good "data hygiene" to keep it under your own control. If someone steals the Firefox sync database now, and some part of the encryption scheme is later broken by e.g. quantum computers, the thieves could retroactively decrypt your sync account data. And there's also the question of metadata - when does your Firefox send data to sync, and how much? Are you sure there's nothing to glean from that?
- smarnach 4y ago
  You are making the assumption that you can secure your own instance of Sync better than Mozilla can secure theirs.
  - smeagull 4y ago
    From Mozilla? Absolutely.
    - acdha 4y ago
      How likely is a scenario where Mozilla abuses their access to the stored data on the sync service but not their ability to ship code in the browser? It seems unlikely for that to have much practical benefit.
  - eqvinox 4y ago
    No, I am making the assumption that I can secure my own VPN better than Mozilla can secure their instance of Sync.
- heywoodlh 4y ago
  > If someone steals the Firefox sync database now, and some part of the encryption scheme is later broken by e.g. quantum computers, the thieves could retroactively decrypt your sync account data. Since cookies and sensitive site data aren't a part of syncing, I guess I could see this being pertinent to your point of data being used to identify you. That being said, if I were a malicious actor, this sounds like a really low reward if you manage to compromise/crack encrypted Firefox Sync data. Ultimately, I agree with your point of reducing information exposure by self-hosting. My line of thought was more wondering what arguments there were on why this may or may not be worth setting up.

eqvinox 4y ago

You could put your self-hosted container in a self-hosted VPN to add a layer of protection. But honestly, while encryption theoretically can make any data "safe" to hand to a 3rd party, it's just good "data hygiene" to keep it under your own control. If someone steals the Firefox sync database now, and some part of the encryption scheme is later broken by e.g. quantum computers, the thieves could retroactively decrypt your sync account data. And there's also the question of metadata - when does your Firefox send data to sync, and how much? Are you sure there's nothing to glean from that?

smarnach 4y ago
You are making the assumption that you can secure your own instance of Sync better than Mozilla can secure theirs.
- smeagull 4y ago
  From Mozilla? Absolutely.
  - acdha 4y ago
    How likely is a scenario where Mozilla abuses their access to the stored data on the sync service but not their ability to ship code in the browser? It seems unlikely for that to have much practical benefit.
- eqvinox 4y ago
  No, I am making the assumption that I can secure my own VPN better than Mozilla can secure their instance of Sync.
heywoodlh 4y ago
> If someone steals the Firefox sync database now, and some part of the encryption scheme is later broken by e.g. quantum computers, the thieves could retroactively decrypt your sync account data. Since cookies and sensitive site data aren't a part of syncing, I guess I could see this being pertinent to your point of data being used to identify you. That being said, if I were a malicious actor, this sounds like a really low reward if you manage to compromise/crack encrypted Firefox Sync data. Ultimately, I agree with your point of reducing information exposure by self-hosting. My line of thought was more wondering what arguments there were on why this may or may not be worth setting up.