5 ms·

As someone who is a big supporter of Firefox Sync [0]: What will this provide me over Firefox Sync, which has a built in encryption layer on their (admittedly

by 616c 13y ago

As someone who is a big supporter of Firefox Sync [0]: What will this provide me over Firefox Sync, which has a built in encryption layer on their (admittedly cloud) service? I can pull their code and host my own Firefox sync server, and someone has written a special PHP-based version for inclusion into OwnCloud. So, what is so special here except the use of buzzword P2P? (See next question below.) How will you do to P2P without some kind of centralized bootstrapping service with the prevalence of NAT and people who do not know how to port-forward? (I just saw the Github repos, so I will examine this myself in a bit.) UPDATE: It would appear you are using mDNS and/or Zeroconf [1] to handle this? I am still not sure how this will ease the NAT and/or syncing over public Internet. Why should I trust you? What have you done other than this project? Not to be increasingly blunt, but you are not the Mozilla Foundation and your Github repos do not show much other than work on co-routines and AD service wrappers. That is useful to me, but I would like to see more security work and knowledge of crypto libraries if I trust you with password manager code. What else do you work on? Your blog does not show me too much, and I cannot find much mention of you to warrant 60,000 USD for such a project. I am correct in seeing you a Marketing/Product Manager? Sorry to be harsh, but honestly I think most of HN would be worried about these points. UPDATE: Ok, maybe I was a little too harsh; you do seem to have some more experience than I had previously estimated, given some Googling and your Linkedin profile, if legit. [2] [0] http://docs.services.mozilla.com/sync/ http://docs.services.mozilla.com/sync/ [1] https://github.com/geertj/bluepass/blob/master/bluepass/locator.py https://github.com/geertj/bluepass/blob/master/bluepass/loca... [2] it.linkedin.com/in/geertj

reedlaw 13y ago
I'm a big fan of Mozilla as well, but can Firefox Sync handle credentials other than for web? I use KeePass2 to store a lot more than just web username/passwords. Also, I like to keep my password database separate from my browser for security reasons. As far as trusting this project, it is GPL and you are free to inspect it. I don't think being part of the Mozilla Foundation somehow guarantees secure code. If the author wants $60,000, he is free to ask for it.
geertj 13y ago
Heh, well thanks for the honesty :) > How will you do to P2P without some kind of centralized bootstrapping service with the prevalence of NAT and people who do not know how to port-forward? (I just saw the Github repos, so I will examine this myself in a bit.) The P2P is done over local networks only. It uses multicast DNS for service discovery. Bluepass syncs between your own devices only. As long as the devices occasionally share a (W)LAN, it will work. > Why should I trust you? What have you done other than this project? Not to be increasingly blunt, but you are not the Mozilla Foundation and your Github repos do not show much other than work on co-routines and AD service wrappers. That is useful to me, but I would like to see more security work and knowledge of crypto libraries if I trust you with password manager code. Well, everybody has to start somewhere. I do believe that I have enough experience with crypto to be qualified here. I've got a physics degree and did a lot of maths. And I read Schneier and Wenbo Mao's book cover to cover. Also note that I'm not using any proprietary algorithms. This is all OpenSSL wrapped algo's that I'm using from Python. But in the end, what should give this the right credibility is that the source code is up on Github, together with my intention to grow a community that can review the crypto. If there is something not right, which can always happen of course, then it will get out sooner or later. > What else do you work on? Your blog does not show me too much, and I cannot find much mention of you to warrant 60,000 USD for such a project. I am correct in seeing you a Marketing/Product Manager? Sorry to be harsh, but honestly I think most of HN would be worried about these points. This is not related to my day job. I would say have a look at the code, and decide for yourself if you like the code. I don't think being a product marketing manager in the day is mutually exclusive with being able to write good code. The calculation of the funds is rather straightforward: $10k for each of the platforms that need work: iOS, Android, Chrome, FF, Mac and Windows.
- drbawb 13y ago
  >As long as the devices occasionally share a (W)LAN, it will work. How about a VPN? I have a work laptop that is rarely (if ever) connected to my home network directly. -- However it is connected to my home network through a VPN daily.
  - 616c 13y ago
geertj 13y ago
Regarding the question around Firefox sync: even if you use your own server, you are sending senstive data that is encrypted with a password or passphrase over the Internet. This opens you up to dictionary attacks now, and if the communications are intercepted, far into the future.
geertj 13y ago
I confirm that [2] is my legitimate Linkedin profile :)

by 616c 13y ago

reedlaw 13y ago

I'm a big fan of Mozilla as well, but can Firefox Sync handle credentials other than for web? I use KeePass2 to store a lot more than just web username/passwords. Also, I like to keep my password database separate from my browser for security reasons. As far as trusting this project, it is GPL and you are free to inspect it. I don't think being part of the Mozilla Foundation somehow guarantees secure code. If the author wants $60,000, he is free to ask for it.

geertj 13y ago

Heh, well thanks for the honesty :) > How will you do to P2P without some kind of centralized bootstrapping service with the prevalence of NAT and people who do not know how to port-forward? (I just saw the Github repos, so I will examine this myself in a bit.) The P2P is done over local networks only. It uses multicast DNS for service discovery. Bluepass syncs between your own devices only. As long as the devices occasionally share a (W)LAN, it will work. > Why should I trust you? What have you done other than this project? Not to be increasingly blunt, but you are not the Mozilla Foundation and your Github repos do not show much other than work on co-routines and AD service wrappers. That is useful to me, but I would like to see more security work and knowledge of crypto libraries if I trust you with password manager code. Well, everybody has to start somewhere. I do believe that I have enough experience with crypto to be qualified here. I've got a physics degree and did a lot of maths. And I read Schneier and Wenbo Mao's book cover to cover. Also note that I'm not using any proprietary algorithms. This is all OpenSSL wrapped algo's that I'm using from Python. But in the end, what should give this the right credibility is that the source code is up on Github, together with my intention to grow a community that can review the crypto. If there is something not right, which can always happen of course, then it will get out sooner or later. > What else do you work on? Your blog does not show me too much, and I cannot find much mention of you to warrant 60,000 USD for such a project. I am correct in seeing you a Marketing/Product Manager? Sorry to be harsh, but honestly I think most of HN would be worried about these points. This is not related to my day job. I would say have a look at the code, and decide for yourself if you like the code. I don't think being a product marketing manager in the day is mutually exclusive with being able to write good code. The calculation of the funds is rather straightforward: $10k for each of the platforms that need work: iOS, Android, Chrome, FF, Mac and Windows.

drbawb 13y ago
>As long as the devices occasionally share a (W)LAN, it will work. How about a VPN? I have a work laptop that is rarely (if ever) connected to my home network directly. -- However it is connected to my home network through a VPN daily.
- 616c 13y ago

geertj 13y ago

Regarding the question around Firefox sync: even if you use your own server, you are sending senstive data that is encrypted with a password or passphrase over the Internet. This opens you up to dictionary attacks now, and if the communications are intercepted, far into the future.

geertj 13y ago

I confirm that [2] is my legitimate Linkedin profile :)