4 ms·
To best of my awareness, the login page (including JS code) is still served over the Internet, and encryption keys are derived solely from the password. That’s
by drdaeman 2y ago
To best of my awareness, the login page (including JS code) is still served over the Internet, and encryption keys are derived solely from the password. That’s not a good design for something as sensitive as one’s full browser data.
- 1oooqooq 2y agosend a pr. but don't know how adding a key owned by moz would make this more trustworthy
- AshamedCaptain 2y agoIt used to be that you could have separate login and encryption passwords. It used to be that you could self-host it as easily as pointing to a separate WebDAV server (trivial to spin up if you have _any_ web server at all). Not anymore.
- eadmund 2y agoAs AshamedCaptain notes, Mozilla actively don’t want an actually-secure password storage protocol. They chose to weaken their security.