31–40 of 94 posts
Earlier quoted context omitted.
As I understand it, using the OS keyring makes it impossible to do synchronization of the passwords (e.g., between mobile device and desktop).
This can't be the explanation, since Chrome manages to sync passwords between devices.
Earlier quoted context omitted.
I fear to know the answer already, but let me ask anyway: does exist any strong password manager that is integrated with Firefox sync?
Firefox Sync is insecure and should not be used. This didn't used to be the case — it used to be world-class — but the engineers decided to utterly destroy its security. All of your remote data is protected by whatever password you use, rather than by a high-entropy key (which means if you choose a poor password you might as well leave your data in plaintext). Worse, they use dynamically-downloaded JavaScript to hand…
Can you elaborate on this? What do you mean by 'protected' and 'high entropy key'? It makes it sound like they aren't key stretching, which seems unlikely. Can you provide a source here?
> Worse, they use dynamically-downloaded JavaScript to handle your password, which means even if you use a high-entropy passphrase Mozilla can at any time send you malicious JavaScript and snarf your passphrase.
I'm unsure why you think Mozilla would do this, or why you would be using Firefox at all if you expect them to push malware to your system.
> This means that any government Mozilla must obey can do the same thing.
I'm not sure this is true, mostly because it lacks any sort of precedent.
Earlier quoted context omitted.
What attack vector would be mitigated by switching to a stronger hashing scheme for this specific use case? And are there other mitigations that exist for this attack vector that would be more appropriate? To me is seems that this feature of browsers is really only meant as a protection against non-advanced attackers accessing an unlocked computer. For this scenario, having a stronger hash would do nothing. Having a…
The argument that "security is pointless unless it can prevent from obtaining the data" is a really tiresome strawman. If you force an adversary to have to keylog for data of interest you already have substantially increased the complexity of bulk attacks, which is the real threat for most users - mass password farming sweeps that can provide easy access to people's entire digital presence in one go.
This sentence is a strawman as you've invented the opponent's argument (literally no one has mentioned the NSA), just for what it's worth.
Your assertions that:
a) An attacker would have to rely on keylogging
b) Keylogging is a substantial barrier for attacker
are unfounded.
I don't understand why firefox doesn't use the underlying OS keyring like Chromium does. I can sort of understand why it currently doesn't (legacy code)... but why the lockbox extension instead of proper OS support? The more places your password is stored the greater the chance of one of them leaking them.
It would actually be a lot easier to gather passwords if all applications used the OS store.
I don't understand why firefox doesn't use the underlying OS keyring like Chromium does. I can sort of understand why it currently doesn't (legacy code)... but why the lockbox extension instead of proper OS support? The more places your password is stored the greater the chance of one of them leaking them.
It doesn't help. All the passwords can be enumerated using the OS API. It would actually be a lot easier to gather passwords if all applications used the OS store.
If anything, the new iMac pro has a Secure Enclave, which means we can soon expect in some number of years that most computers will as well.
Fixing issues like this is clearly less important than implementing browser-side VR support, I don't see what Palant is on about. As a Firefox user, trading the security of any and all accounts I store passwords for in the browser is something I'd gladly exchange for ... anyway, VR is cool, right? Guess I should dump the password store and go all-in on the 1Password extension.
Ah yes, they should re-assign all their generic swiss-army engineers from VR to Security.
The way current browsers operate, makes it really inconvenient to use a master password, because each time you visit a page for which a password is stored, it will prompt you to enter a master password. This way you can't have a feature where master password is forgotten after for example 10 minutes of not using it.
Such behavior makes one either to not use master password at all, or enter it and be in memory for the entire time a browser is running.
Also pressing Command+Enter or Ctrl+Enter log in to a website was so much faster and convenient than the current way.
[1] Note I'm talking about actual Opera browser which sadly no longer exists, the current Opera browser is just a Chrome with a different skin.
Earlier quoted context omitted.
It doesn't help. All the passwords can be enumerated using the OS API. It would actually be a lot easier to gather passwords if all applications used the OS store.
But you still need to unlock the keychain to get those... so what’s the difference? If anything, the new iMac pro has a Secure Enclave, which means we can soon expect in some number of years that most computers will as well.
Do you know that windows has had password stores for many decades?
There are ~100,000 people in the world that would think to run a GPU password cracker on your Firefox master password hash, if they had access and wanted to snoop.
There are ~1,000,000,000 people that would think to open your browser and go to a website you use to try to gain access to it.
In some sense, although it's hard to quantify security, using a master password is 10,000x more effective than not.
Earlier quoted context omitted.
Firefox Sync is insecure and should not be used. This didn't used to be the case — it used to be world-class — but the engineers decided to utterly destroy its security. All of your remote data is protected by whatever password you use, rather than by a high-entropy key (which means if you choose a poor password you might as well leave your data in plaintext). Worse, they use dynamically-downloaded JavaScript to hand…
> All of your remote data is protected by whatever password you use, rather than by a high-entropy key (which means if you choose a poor password you might as well leave your data in plaintext). Can you elaborate on this? What do you mean by 'protected' and 'high entropy key'? It makes it sound like they aren't key stretching, which seems unlikely. Can you provide a source here? > Worse, they use dynamically-download…
I can't be sure, but I believe GP is referring to how Firefox Sync originally encrypted all the data locally with a long key before uploading it to Mozilla servers. To sync your data onto a new device you would have to transfer the key, which was done by generating a 16 char temporary password at one end, and then typing it at the other. Your private key data would then be sent, encrypted, to the new device.
At some point, if memory serves, Mozilla decided this was too complicated for ordinary users, and now only stores your sync data protected by whatever password you type in - which is going to be potentially brute-forceable.