5 ms·

Can Chrome Sync or Firefox Sync be trusted with sensitive data? (2018)

42 points by c5karl 3y ago

l1n 3y ago
https://bugzilla.mozilla.org/show_bug.cgi?id=1320222 https://bugzilla.mozilla.org/show_bug.cgi?id=1320222, doesn't seem conclusive to me wrt Firefox Sync safety
deadbunny 3y ago
Google/Chrome can't even be trusted with you bookmarks. https://strangeobject.space/@silvermoon82/110969122337810598 https://strangeobject.space/@silvermoon82/110969122337810598
- bloopernova 3y ago
  The item that was "moderated" was in a collection, which isn't a bookmark. https://www.google.com/save/ https://www.google.com/save/ That's where collections live, and apparently they can be shared. Not to defend google, for sure. I just wanted to stop the spread of incorrect information. EDIT: I like many others didn't know about this feature and had no idea what was saved there or how it got there.
  - Pannoniae 3y ago
    Still very pathetic. Google has zero business in interfering in private data seen by no one else. They are providing a service to store things, not to "moderate" or to publish them. The terminology might have been inaccurate but in spirit, it's the same. It's a disgrace.
- deleted 3y ago
  [deleted]
  - deleted 3y ago
    [deleted]
- insanitybit 3y ago
  That's completely irrelevant to the content of this piece.
quantumstar4k 3y ago
Might be redundant, but it looks like the Chrome devs fixed this issue back in 2020. https://bugs.chromium.org/p/chromium/issues/detail?id=820976 https://bugs.chromium.org/p/chromium/issues/detail?id=820976
- palant 3y ago
  Note: I am the author of this article. They fixed this particular issue (and a few more), the article mentions it. But the update I published today explains why Chrome Sync is still very bad privacy-wise (as opposed to outright horrible which it was back in 2018). https://palant.info/2023/08/29/chrome-sync-privacy-is-still-very-bad/ https://palant.info/2023/08/29/chrome-sync-privacy-is-still-...
cap10morgan 3y ago
Important caveat with Firefox: You can run your own Firefox Account server (see https://mozilla-services.readthedocs.io/en/latest/howtos/run-fxa.html https://mozilla-services.readthedocs.io/en/latest/howtos/run...) and then e.g. connect to it over a VPN to mitigate a lot of this.
- WirelessGigabit 3y ago
  Problem with this is that it needs the sync server: > Since the Mozilla-hosted sync servers will not trust assertions issued by third-party accounts servers, you will also need to run your own sync-1.5 server. The tutorial refers to the old unmaintained version: https://github.com/mozilla-services/syncserver https://github.com/mozilla-services/syncserver, see https://github.com/mozilla-services/syncserver/commit/8d98040d37a07730b3e6029df71dfef112a0f5a2 https://github.com/mozilla-services/syncserver/commit/8d9804... The alternative is https://github.com/mozilla-services/syncstorage-rs https://github.com/mozilla-services/syncstorage-rs which is ridiculously hard to set up.
  - JetSpiegel 3y ago
    > The alternative is https://github.com/mozilla-services/syncstorage-rs https://github.com/mozilla-services/syncstorage-rs which is ridiculously hard to set up. https://github.com/mozilla-services/syncstorage-rs/issues/498 https://github.com/mozilla-services/syncstorage-rs/issues/49... This is the issue to watch, supporting SQLite. This makes it feasible to run a simple sync server for a single user or a small group. But this is not moving forward.
  - asabla 3y ago
    I got stuck with the new one as well last time I tried. But it seems like there is an docker option now, which seems to make things a lot easier
  - 3np 3y ago
    I've posted on this a few times. Rehashing[0]: > https://github.com/mozilla-services/syncserver/pull/294 https://github.com/mozilla-services/syncserver/pull/294 > So basically they stopped running the older version themselves but don't consider the newer version production-ready yet. What a mess. This doesn't seem to have improved much since... Some of my experience self-hosting the whole stack previously: https://news.ycombinator.com/item?id=30315816 https://news.ycombinator.com/item?id=30315816 https://news.ycombinator.com/item?id=30727935 https://news.ycombinator.com/item?id=30727935 [0]: https://news.ycombinator.com/item?id=30728966 https://news.ycombinator.com/item?id=30728966
jeffbee 3y ago
2018.
insanitybit 3y ago
(2018)
aodj 3y ago
This article is from 2018, and contains a single update from 2020. I would think the terrain has shifted in the last 3 years, so take the article with an appropriate pinch of salt.
- aodj 3y ago
  Digging around there appears to be a newer article (which probably prompted the original thread) is here https://palant.info/2023/08/29/chrome-sync-privacy-is-still-very-bad/ https://palant.info/2023/08/29/chrome-sync-privacy-is-still-... which has it's own HN thread here
  - jeffbee 3y ago
    Isn't it somewhat hilarious that the author of Adblock Plus, far and away the largest privacy risk faced by anyone, throws this much shade on Google's privacy protections? ABP gets unfettered, full and complete access to all your data no matter how sensitive and only the publisher's OpSec stands between the user and total exposure.
    - michaelmrose 3y ago
      Google is already in possession and presently selling information on you. Adblockers like basically every piece of poorly segregated software on your system is in a position to compromise your privacy. Both are concerns but one does appear more immediate.
    - taeric 3y ago
      I'm not sure I see the humor? Also not sure how Adblock Plus is far and away the largest privacy risk for anyone? I'm sympathetic to wanting to limit data access to things. But this data seems to already be available to the browser? Having a separate process to manage that seems somewhat natural?
    - palant 3y ago
      Note: I am the author of this article. Every ad blocker gets full and complete access to all your data. It needs that kind of access in order to … tada … remove ads. It’s really simple: ads are on all websites, so an ad blocker needs access to all websites. You probably mean that Adblock Plus abuses this access? Surely this is something you have proof for? Here you can see an example of how this kind of thing looks like: https://palant.info/2023/06/05/introducing-pcvark-and-their-malicious-ad-blockers/ https://palant.info/2023/06/05/introducing-pcvark-and-their-.... You can look around in my blog, there is more. It has been a while since I’ve been involved with Adblock Plus. I sincerely doubt however that ABP’s privacy stance changed that much since I’ve left. But I’ll wait for you to find proof for your claims.
rapnie 3y ago
This article probably re-submitted, because a recent update to it did not make it to the front page: https://palant.info/2023/08/29/chrome-sync-privacy-is-still-very-bad/ https://palant.info/2023/08/29/chrome-sync-privacy-is-still-...
- deleted 3y ago
  [deleted]
JohnDeHope 3y ago
> Can [any storage that is not physically in my possession] be trusted with sensitive data? No. You could make a case for E2E encrypted data where the storage provider does not have keys. That's pretty rare though. The point is, nobody gives a flip about your privacy. As soon as men with guns come asking for your data, any data business will hand it over without hesitation. Men with badges are only very slightly less threatening than men with guns, as everybody knows who the men with guns work for. So if you think anybody or any business is going to die on the hill of protecting your donkey porn collection, you're delusional.
- deleted 3y ago
  [deleted]
- palant 3y ago
  Note: I am the author of this article. Firefox Sync encrypts all data on the client side before sending it. Chrome Sync can do the same if you know which settings to use. 1Password, Bitwarden, Dashlane – every password manager worth their salt encrypts data locally (LastPass is the only one which failed really badly here). How is this rare and not something we should expect?
andrewmutz 3y ago
> Update (2020-06-10): The issue has been resolved in Chrome 80. The key derivation algorithm used now is scrypt with N=8192, r=8, p=11. These values are sane and should make attacks against most passwords unrealistic.
- palant 3y ago
  Note: I am the author of this article. Yes, they fixed this particular issue (and a few more), the article mentions it. But the update I published today explains why Chrome Sync is still very bad privacy-wise (as opposed to outright horrible which it was back in 2018). https://palant.info/2023/08/29/chrome-sync-privacy-is-still-very-bad/ https://palant.info/2023/08/29/chrome-sync-privacy-is-still-...
Daril 3y ago
There are solutions external to the browsers that work pretty well and where you have control on your data : Floccus for bookmarks (https://floccus.org/ https://floccus.org/) : it works also on mobile devices : a great plus ! You need only a webdav server (or a Nextcloud account), I use Dave (https://github.com/micromata/dave https://github.com/micromata/dave) Vaultwarden for the passwords (https://github.com/dani-garcia/vaultwarden https://github.com/dani-garcia/vaultwarden) A huge advantage of this solution is that you can have synchronization also between different browsers and on mobile devices.
dang 3y ago
Recent and related: Google moderates Google Collections items - https://news.ycombinator.com/item?id=37301600 https://news.ycombinator.com/item?id=37301600 - Aug 2023 (38 comments)

42 points by c5karl 3y ago

l1n 3y ago

https://bugzilla.mozilla.org/show_bug.cgi?id=1320222 https://bugzilla.mozilla.org/show_bug.cgi?id=1320222, doesn't seem conclusive to me wrt Firefox Sync safety

deadbunny 3y ago

Google/Chrome can't even be trusted with you bookmarks. https://strangeobject.space/@silvermoon82/110969122337810598 https://strangeobject.space/@silvermoon82/110969122337810598

bloopernova 3y ago
The item that was "moderated" was in a collection, which isn't a bookmark. https://www.google.com/save/ https://www.google.com/save/ That's where collections live, and apparently they can be shared. Not to defend google, for sure. I just wanted to stop the spread of incorrect information. EDIT: I like many others didn't know about this feature and had no idea what was saved there or how it got there.
- Pannoniae 3y ago
  Still very pathetic. Google has zero business in interfering in private data seen by no one else. They are providing a service to store things, not to "moderate" or to publish them. The terminology might have been inaccurate but in spirit, it's the same. It's a disgrace.
deleted 3y ago
[deleted]
- deleted 3y ago
  [deleted]
insanitybit 3y ago
That's completely irrelevant to the content of this piece.

quantumstar4k 3y ago

Might be redundant, but it looks like the Chrome devs fixed this issue back in 2020. https://bugs.chromium.org/p/chromium/issues/detail?id=820976 https://bugs.chromium.org/p/chromium/issues/detail?id=820976

palant 3y ago
Note: I am the author of this article. They fixed this particular issue (and a few more), the article mentions it. But the update I published today explains why Chrome Sync is still very bad privacy-wise (as opposed to outright horrible which it was back in 2018). https://palant.info/2023/08/29/chrome-sync-privacy-is-still-very-bad/ https://palant.info/2023/08/29/chrome-sync-privacy-is-still-...

cap10morgan 3y ago

Important caveat with Firefox: You can run your own Firefox Account server (see https://mozilla-services.readthedocs.io/en/latest/howtos/run-fxa.html https://mozilla-services.readthedocs.io/en/latest/howtos/run...) and then e.g. connect to it over a VPN to mitigate a lot of this.

WirelessGigabit 3y ago
Problem with this is that it needs the sync server: > Since the Mozilla-hosted sync servers will not trust assertions issued by third-party accounts servers, you will also need to run your own sync-1.5 server. The tutorial refers to the old unmaintained version: https://github.com/mozilla-services/syncserver https://github.com/mozilla-services/syncserver, see https://github.com/mozilla-services/syncserver/commit/8d98040d37a07730b3e6029df71dfef112a0f5a2 https://github.com/mozilla-services/syncserver/commit/8d9804... The alternative is https://github.com/mozilla-services/syncstorage-rs https://github.com/mozilla-services/syncstorage-rs which is ridiculously hard to set up.
- JetSpiegel 3y ago
  > The alternative is https://github.com/mozilla-services/syncstorage-rs https://github.com/mozilla-services/syncstorage-rs which is ridiculously hard to set up. https://github.com/mozilla-services/syncstorage-rs/issues/498 https://github.com/mozilla-services/syncstorage-rs/issues/49... This is the issue to watch, supporting SQLite. This makes it feasible to run a simple sync server for a single user or a small group. But this is not moving forward.
- asabla 3y ago
  I got stuck with the new one as well last time I tried. But it seems like there is an docker option now, which seems to make things a lot easier
- 3np 3y ago
  I've posted on this a few times. Rehashing[0]: > https://github.com/mozilla-services/syncserver/pull/294 https://github.com/mozilla-services/syncserver/pull/294 > So basically they stopped running the older version themselves but don't consider the newer version production-ready yet. What a mess. This doesn't seem to have improved much since... Some of my experience self-hosting the whole stack previously: https://news.ycombinator.com/item?id=30315816 https://news.ycombinator.com/item?id=30315816 https://news.ycombinator.com/item?id=30727935 https://news.ycombinator.com/item?id=30727935 [0]: https://news.ycombinator.com/item?id=30728966 https://news.ycombinator.com/item?id=30728966

jeffbee 3y ago

2018.

insanitybit 3y ago

(2018)

aodj 3y ago

This article is from 2018, and contains a single update from 2020. I would think the terrain has shifted in the last 3 years, so take the article with an appropriate pinch of salt.

aodj 3y ago
Digging around there appears to be a newer article (which probably prompted the original thread) is here https://palant.info/2023/08/29/chrome-sync-privacy-is-still-very-bad/ https://palant.info/2023/08/29/chrome-sync-privacy-is-still-... which has it's own HN thread here
- jeffbee 3y ago
  Isn't it somewhat hilarious that the author of Adblock Plus, far and away the largest privacy risk faced by anyone, throws this much shade on Google's privacy protections? ABP gets unfettered, full and complete access to all your data no matter how sensitive and only the publisher's OpSec stands between the user and total exposure.
  - michaelmrose 3y ago
    Google is already in possession and presently selling information on you. Adblockers like basically every piece of poorly segregated software on your system is in a position to compromise your privacy. Both are concerns but one does appear more immediate.
  - taeric 3y ago
    I'm not sure I see the humor? Also not sure how Adblock Plus is far and away the largest privacy risk for anyone? I'm sympathetic to wanting to limit data access to things. But this data seems to already be available to the browser? Having a separate process to manage that seems somewhat natural?
  - palant 3y ago
    Note: I am the author of this article. Every ad blocker gets full and complete access to all your data. It needs that kind of access in order to … tada … remove ads. It’s really simple: ads are on all websites, so an ad blocker needs access to all websites. You probably mean that Adblock Plus abuses this access? Surely this is something you have proof for? Here you can see an example of how this kind of thing looks like: https://palant.info/2023/06/05/introducing-pcvark-and-their-malicious-ad-blockers/ https://palant.info/2023/06/05/introducing-pcvark-and-their-.... You can look around in my blog, there is more. It has been a while since I’ve been involved with Adblock Plus. I sincerely doubt however that ABP’s privacy stance changed that much since I’ve left. But I’ll wait for you to find proof for your claims.

rapnie 3y ago

This article probably re-submitted, because a recent update to it did not make it to the front page: https://palant.info/2023/08/29/chrome-sync-privacy-is-still-very-bad/ https://palant.info/2023/08/29/chrome-sync-privacy-is-still-...

deleted 3y ago
[deleted]

JohnDeHope 3y ago

> Can [any storage that is not physically in my possession] be trusted with sensitive data? No. You could make a case for E2E encrypted data where the storage provider does not have keys. That's pretty rare though. The point is, nobody gives a flip about your privacy. As soon as men with guns come asking for your data, any data business will hand it over without hesitation. Men with badges are only very slightly less threatening than men with guns, as everybody knows who the men with guns work for. So if you think anybody or any business is going to die on the hill of protecting your donkey porn collection, you're delusional.

deleted 3y ago
[deleted]
palant 3y ago
Note: I am the author of this article. Firefox Sync encrypts all data on the client side before sending it. Chrome Sync can do the same if you know which settings to use. 1Password, Bitwarden, Dashlane – every password manager worth their salt encrypts data locally (LastPass is the only one which failed really badly here). How is this rare and not something we should expect?

andrewmutz 3y ago

> Update (2020-06-10): The issue has been resolved in Chrome 80. The key derivation algorithm used now is scrypt with N=8192, r=8, p=11. These values are sane and should make attacks against most passwords unrealistic.

palant 3y ago
Note: I am the author of this article. Yes, they fixed this particular issue (and a few more), the article mentions it. But the update I published today explains why Chrome Sync is still very bad privacy-wise (as opposed to outright horrible which it was back in 2018). https://palant.info/2023/08/29/chrome-sync-privacy-is-still-very-bad/ https://palant.info/2023/08/29/chrome-sync-privacy-is-still-...

Daril 3y ago

There are solutions external to the browsers that work pretty well and where you have control on your data : Floccus for bookmarks (https://floccus.org/ https://floccus.org/) : it works also on mobile devices : a great plus ! You need only a webdav server (or a Nextcloud account), I use Dave (https://github.com/micromata/dave https://github.com/micromata/dave) Vaultwarden for the passwords (https://github.com/dani-garcia/vaultwarden https://github.com/dani-garcia/vaultwarden) A huge advantage of this solution is that you can have synchronization also between different browsers and on mobile devices.

dang 3y ago

Recent and related: Google moderates Google Collections items - https://news.ycombinator.com/item?id=37301600 https://news.ycombinator.com/item?id=37301600 - Aug 2023 (38 comments)