4 ms·

What's the privacy benefit, given that Firefox Sync is E2E encrypted? https://support.mozilla.org/en-US/kb/sync https://support.mozilla.org/en-US/kb/sync

• drdaeman 2y ago
  To best of my awareness, the login page (including JS code) is still served over the Internet, and encryption keys are derived solely from the password. That’s not a good design for something as sensitive as one’s full browser data.
  • 1oooqooq 2y ago
    send a pr. but don't know how adding a key owned by moz would make this more trustworthy
    • AshamedCaptain 2y ago
      It used to be that you could have separate login and encryption passwords. It used to be that you could self-host it as easily as pointing to a separate WebDAV server (trivial to spin up if you have _any_ web server at all). Not anymore.
    • eadmund 2y ago
      As AshamedCaptain notes, Mozilla actively don’t want an actually-secure password storage protocol. They chose to weaken their security.
• vedmed 2y ago
  [flagged]