3 ms·

This is a ridiculous and rather arrogant response. First off, if the user doesn't understand something, you can't just always blame the user. It in fact did com

This is a ridiculous and rather arrogant response. First off, if the user doesn't understand something, you can't just always blame the user. It in fact did completely bork my synced data. I don't care what you want to call it, if user's lose data there's a problem somewhere in the design of the sync system. No where in the user-flow did it say anything about losing data if you reset the recovery key. These confusions are why they're changing the FF sync system!

zobzu 13y ago
there is no recovery key in old sync AFAIK. you delete the single, only mail key. (also, that's why old sync is "not a backup system") the new sync actually seems to have plans for a recovery key and be a "backup system", which seems more inline with users expectations
- mikegioia 13y ago
  Ah I see. I'm looking forward to the new system. Chrome's sync was easy and worked well and it's the one thing I really miss.
- zobzu 13y ago
  mail=main.
comex 13y ago
True, if you accidentally lost data, this suggests the documentation should be better. But this is not entirely changing: class-A: data assigned to this class can be recovered, even if the user forgets their password, by proving control over an email address and resetting the account. It can also be read by Mozilla (since it runs the keyserver and knows kA), or by the user's IdP (by resetting the account without the user's permission). class-B: data in this class cannot be recovered if the password is forgotten. It cannot be read by the IdP. Mozilla (via the keyserver) cannot read this data, but can attempt a brute-force dictionary attack against the password. - https://github.com/mozilla/fxa-auth-server/wiki/onepw-protocol https://github.com/mozilla/fxa-auth-server/wiki/onepw-protoc... We do not yet know which data will be assigned to which category by default, but it is likely that saved-passwords will go into class-B, and many other datatypes will default to class-A. There will be an option to put all data into Class-B. - https://wiki.mozilla.org/Identity/AttachedServices/Architecture#Data_Security https://wiki.mozilla.org/Identity/AttachedServices/Architect... (not sure if out of date) ...and for good reason, because since Mozilla presumably wants to avoid being required to hand over account data by governments to the greatest extent possible. Being able to reset your password via email necessarily makes it possible for Mozilla to decrypt that data.

zobzu 13y ago

there is no recovery key in old sync AFAIK. you delete the single, only mail key. (also, that's why old sync is "not a backup system") the new sync actually seems to have plans for a recovery key and be a "backup system", which seems more inline with users expectations

mikegioia 13y ago
Ah I see. I'm looking forward to the new system. Chrome's sync was easy and worked well and it's the one thing I really miss.
zobzu 13y ago
mail=main.

comex 13y ago

True, if you accidentally lost data, this suggests the documentation should be better. But this is not entirely changing: class-A: data assigned to this class can be recovered, even if the user forgets their password, by proving control over an email address and resetting the account. It can also be read by Mozilla (since it runs the keyserver and knows kA), or by the user's IdP (by resetting the account without the user's permission). class-B: data in this class cannot be recovered if the password is forgotten. It cannot be read by the IdP. Mozilla (via the keyserver) cannot read this data, but can attempt a brute-force dictionary attack against the password. - https://github.com/mozilla/fxa-auth-server/wiki/onepw-protocol https://github.com/mozilla/fxa-auth-server/wiki/onepw-protoc... We do not yet know which data will be assigned to which category by default, but it is likely that saved-passwords will go into class-B, and many other datatypes will default to class-A. There will be an option to put all data into Class-B. - https://wiki.mozilla.org/Identity/AttachedServices/Architecture#Data_Security https://wiki.mozilla.org/Identity/AttachedServices/Architect... (not sure if out of date) ...and for good reason, because since Mozilla presumably wants to avoid being required to hand over account data by governments to the greatest extent possible. Being able to reset your password via email necessarily makes it possible for Mozilla to decrypt that data.