6 ms·

A Better Firefox Sync

87 points by lelf 13y ago

ubercow13 13y ago
Doesn't seem to be working very well on Nightly for me
- ack 13y ago
  Works ok on nightly for me. I'm just waiting for this to be implemented on Firefox Mobile so I can continue to actually sync between all my machines again.
ubojan 13y ago
good news. I hope that new sync feature will work seamlessly and efficiently - I disabled sync about a year ago because browser became sluggish with large number of bookmarks.
- codygman 13y ago
  Interesting, I've been using Firefox sync since it was released on Iceweasel (Debian Firefox) and had absolutely 0 problems.
Siecje 13y ago
Can you sync add-on settings?
- sho_hn 13y ago
  Yes: https://developer.mozilla.org/en-US/docs/Firefox_Sync/Syncing_custom_preferences https://developer.mozilla.org/en-US/docs/Firefox_Sync/Syncin...
- KORraN 13y ago
  In theory - yes. I checked option "Use Weave/Firefox to sync white list" in Flash Block. Recently I was playing with VM and I synced Iceweasel on Debian (remembering about marking option to remove local data and use synced data). It got everything except white list. Sadly, white list from original Firefox has been also lost :(
mikegioia 13y ago
Just today I reinstalled Ubuntu on a laptop and the sync completely borked. What I don't understand is why does it first ask you for a pair code from another device? My only other device was a desktop far away. After I logged in and clicked "reset sync key" it apparently lost all of the synced data! I seriously hope this solves the currently heinous sync process. Just let me log in an authorize myself for goodness sake.
- kevingadd 13y ago
  Aside from the fact that yes, pair codes are annoying - it sounds like you didn't understand Sync at all and were upset that it wouldn't compromise basic security guarantees for ease of use? In the old system, the pair code was effectively a password. It's obvious that resetting the sync key wiped out your synced data; the synced data was encrypted with the old key and generating a new one obviously wouldn't let you decrypt it. (It's possible the old key can still be used to recover the data, but I'm not sure). Complaining that it demanded a pair code is like complaining that gmail asks you for a 2fa code after you've turned on 2fa. Of course it does, that's how the security works. Of course, the pair code system is kind of a pain, so they introduced passwords. But the pair code system does work if you use it correctly. I don't think it's fair to call it 'completely borked' when your problems are entirely down to user error. Keep in mind that Firefox Sync always protects all your profile data; Mozilla can't access it because your machines encrypt it. This is unlike Chrome's profile sync where all the data lives on Google's servers and is accessible to them. As a result the authentication can't be as simple as 'sign in with your gmail account' or something like that.
  - ultramancool 13y ago
    > This is unlike Chrome's profile sync where all the data lives on Google's servers and is accessible to them. This is not true. When you configure chrome's sync you can set an encryption password separate from your Google password and select items for encrypted sync. Though in my opinion Firefox Sync had the better method here security wise.
    - 13y ago
antonio0 13y ago
Finally! The tedious way Firefox Sync used to work is the main reason I use Google Chrome.
magicalist 13y ago
The Sync protocol document is (linked in the article) has a lot of interesting details about the new system: https://github.com/mozilla/fxa-auth-server/wiki/onepw-protocol https://github.com/mozilla/fxa-auth-server/wiki/onepw-protoc...
seanieb 13y ago
On Password reuse - Implementing a one factor, password based auth puts the accounts security in the users hands. There are lots of email, password lists from hacked web services (Linkedin,Yahoo Voices, Gawker, etc.) in the wild and users all too commonly reuse their weak passwords across multiple services. If a user couldn’t figure out how to set up Firefox Sync previously by following the instructions and taking a set of digits from one device and entering them into another, what hope have they of picking a strong and unique password?
ParkerK 13y ago
I wish they'd port some form of the sync to iOS. Syncing between my phone and my laptop is the only reason I'm still on Chrome
- philamonster 13y ago
  Used to be able to use FF Sync with Mercury but they've gone and ruined it with their own sync service.
  - ParkerK 13y ago
    Not sure why they can't just slap something together like Chrome for iOS. Sure, it won't be the real firefox, but I just want to access my passwords, history, and such easily
- JohnTHaller 13y ago
  Mozilla would love to have Firefox on iOS. You just need to convince Apple to change their terms of service to allow real 3rd party browsers (as opposed to UI skins atop the slower version of Safari).
  - ParkerK 13y ago
    What chrome did is fine for me. I don't need a super snappy web browser for mobile sites. I'd be fine with a UI that syncs with Firefox on top of WebKit
    - JohnTHaller 13y ago
      I don't think Firefox would be keen on (1) having a webkit-based browser with the name Firefox and (2) having it be an intentionally-hobbled browser compared to Safari so Apple can ensure its browser is the 'fastest' on iOS. Google made the decision with Chrome, since it is also webkit, but it will likely bite them in the ass later as blink continues to be improved and webkit begins to stagnate more. And as they begin to have differing rendering bugs.
agumonkey 13y ago
I enjoyed the extremly minimal cost of entry in terms of UX. But it's just a little bit too ~naked. I don't know when or if the sync has been done (maybe my system lacks some DE notification) and I have no other way to see what has been synced, I can' t find a browser based interface for the account. account.mozilla.... restricts itself as a login form.

87 points by lelf 13y ago

ubercow13 13y ago

Doesn't seem to be working very well on Nightly for me

ack 13y ago
Works ok on nightly for me. I'm just waiting for this to be implemented on Firefox Mobile so I can continue to actually sync between all my machines again.

ubojan 13y ago

good news. I hope that new sync feature will work seamlessly and efficiently - I disabled sync about a year ago because browser became sluggish with large number of bookmarks.

codygman 13y ago
Interesting, I've been using Firefox sync since it was released on Iceweasel (Debian Firefox) and had absolutely 0 problems.

Siecje 13y ago

Can you sync add-on settings?

sho_hn 13y ago
Yes: https://developer.mozilla.org/en-US/docs/Firefox_Sync/Syncing_custom_preferences https://developer.mozilla.org/en-US/docs/Firefox_Sync/Syncin...
KORraN 13y ago
In theory - yes. I checked option "Use Weave/Firefox to sync white list" in Flash Block. Recently I was playing with VM and I synced Iceweasel on Debian (remembering about marking option to remove local data and use synced data). It got everything except white list. Sadly, white list from original Firefox has been also lost :(

mikegioia 13y ago

Just today I reinstalled Ubuntu on a laptop and the sync completely borked. What I don't understand is why does it first ask you for a pair code from another device? My only other device was a desktop far away. After I logged in and clicked "reset sync key" it apparently lost all of the synced data! I seriously hope this solves the currently heinous sync process. Just let me log in an authorize myself for goodness sake.

kevingadd 13y ago
Aside from the fact that yes, pair codes are annoying - it sounds like you didn't understand Sync at all and were upset that it wouldn't compromise basic security guarantees for ease of use? In the old system, the pair code was effectively a password. It's obvious that resetting the sync key wiped out your synced data; the synced data was encrypted with the old key and generating a new one obviously wouldn't let you decrypt it. (It's possible the old key can still be used to recover the data, but I'm not sure). Complaining that it demanded a pair code is like complaining that gmail asks you for a 2fa code after you've turned on 2fa. Of course it does, that's how the security works. Of course, the pair code system is kind of a pain, so they introduced passwords. But the pair code system does work if you use it correctly. I don't think it's fair to call it 'completely borked' when your problems are entirely down to user error. Keep in mind that Firefox Sync always protects all your profile data; Mozilla can't access it because your machines encrypt it. This is unlike Chrome's profile sync where all the data lives on Google's servers and is accessible to them. As a result the authentication can't be as simple as 'sign in with your gmail account' or something like that.
- ultramancool 13y ago
  > This is unlike Chrome's profile sync where all the data lives on Google's servers and is accessible to them. This is not true. When you configure chrome's sync you can set an encryption password separate from your Google password and select items for encrypted sync. Though in my opinion Firefox Sync had the better method here security wise.
  - 13y ago

antonio0 13y ago

Finally! The tedious way Firefox Sync used to work is the main reason I use Google Chrome.

magicalist 13y ago

The Sync protocol document is (linked in the article) has a lot of interesting details about the new system: https://github.com/mozilla/fxa-auth-server/wiki/onepw-protocol https://github.com/mozilla/fxa-auth-server/wiki/onepw-protoc...

seanieb 13y ago

On Password reuse - Implementing a one factor, password based auth puts the accounts security in the users hands. There are lots of email, password lists from hacked web services (Linkedin,Yahoo Voices, Gawker, etc.) in the wild and users all too commonly reuse their weak passwords across multiple services. If a user couldn’t figure out how to set up Firefox Sync previously by following the instructions and taking a set of digits from one device and entering them into another, what hope have they of picking a strong and unique password?

ParkerK 13y ago

I wish they'd port some form of the sync to iOS. Syncing between my phone and my laptop is the only reason I'm still on Chrome

philamonster 13y ago
Used to be able to use FF Sync with Mercury but they've gone and ruined it with their own sync service.
- ParkerK 13y ago
  Not sure why they can't just slap something together like Chrome for iOS. Sure, it won't be the real firefox, but I just want to access my passwords, history, and such easily
JohnTHaller 13y ago
Mozilla would love to have Firefox on iOS. You just need to convince Apple to change their terms of service to allow real 3rd party browsers (as opposed to UI skins atop the slower version of Safari).
- ParkerK 13y ago
  What chrome did is fine for me. I don't need a super snappy web browser for mobile sites. I'd be fine with a UI that syncs with Firefox on top of WebKit
  - JohnTHaller 13y ago
    I don't think Firefox would be keen on (1) having a webkit-based browser with the name Firefox and (2) having it be an intentionally-hobbled browser compared to Safari so Apple can ensure its browser is the 'fastest' on iOS. Google made the decision with Chrome, since it is also webkit, but it will likely bite them in the ass later as blink continues to be improved and webkit begins to stagnate more. And as they begin to have differing rendering bugs.

agumonkey 13y ago

I enjoyed the extremly minimal cost of entry in terms of UX. But it's just a little bit too ~naked. I don't know when or if the sync has been done (maybe my system lacks some DE notification) and I have no other way to see what has been synced, I can' t find a browser based interface for the account. account.mozilla.... restricts itself as a login form.