This is interesting, and I'm looking forward to seeing where it goes.
However, it's very unlikely to replace Bitwarden for me.
Firefox Lockbox
31–40 of 156 posts
Re: Firefox Lockbox
#32Does this have safari integration? Will it support iOS 12 auto fill? Most importantly, how likely is this gonna disappear after a year or two like so many other Mozilla side projects?
Most likely. The iOS guys that work on Mozilla apps are pretty tech savvy and use latest Apple technology.
I appreciate the vote of confidence but I was hoping someone from the team could chime in or someone who took the time to try it out. Based on other comments in this thread it looks like it may just rely heavily on copy/paste.
Re: Firefox Lockbox
#33Does this have safari integration? Will it support iOS 12 auto fill? Most importantly, how likely is this gonna disappear after a year or two like so many other Mozilla side projects?
Most likely. The iOS guys that work on Mozilla apps are pretty tech savvy and use latest Apple technology.
Yes, us guys and gals working on the app are planning on the iOS 12 autofill API integration: https://github.com/mozilla-lockbox/lockbox-ios/issues/445
Re: Firefox Lockbox
#34From the link, it claims that this "gives access to all the logins you've saved in Firefox", but I thought it was common knowledge that in-browser password storage is insecure? [0,1] If so, then this doesn't really promote much confidence in a product that appears to be a password manager. If they've addressed this issue, then that should probably be explicitly stated, although I understand the difficulties of that f…
> in-browser password storage is insecure > (If you don't use a master password, which isn't required, I believe?) When using a cloud-synced password vault that lands on the servers of a third party (this includes Firefox, Google, 1Password, Lastpass, etc.) you must always assume that the file itself is compromised; the only thing between an attacker and your passwords is the encryption by your master key. I seriousl…
> I seriously doubt that Firefox Lockbox will allow you to cloud-sync your password file without setting a master password.
The current Firefox Accounts protocol simply encrypts a master key with a key derived from the account password. That's not terrible, although it does mean that account passwords must be cryptographically strong. However, Firefox Accounts can be logged into from a webpage which executes JavaScript served dynamically, which means that Mozilla, a Mozilla employee or any government or organisation which can compel Mozilla or Mozilla employees can serve targeted JavaScript to you to steal your master password, and then silently read your passwords. As such, Firefox accounts cannot be trusted with high-security passwords.
(Yes, you have to trust Mozilla to run Firefox at all, but it's significantly easier to hide a single download of a compromised JavaScript file than it is to hide a compromised Firefox binary served to the world)
Re: Firefox Lockbox
#35I am curious how it works, technically speaking.
I already have this capability with password-store (pass), that works for Firefox, Chrome and Safari on destop and mobile.
pass - https://www.passwordstore.org (core program)
passff - https://github.com/jvenant/passff (firefox desktop)
passforios - https://mssun.github.io/passforios (ios w/firefox mobile)
qtpass - http://qtpass.org (osx, linux, windows)
Re: Firefox Lockbox
#36Has anyone done a thoughtful comparison of PW managers?
I moved on from keepass because it was a huge hassle to use, but LastPass and 1password both have some detractors as well.
Re: Firefox Lockbox
#37The iOS app seems to be region-locked to U.S. only App Store.
Only for now. This is just the beginning of an experimental product and we're hoping to bring it far and wide later.
Other than "every", what language or regions would you want/expect/need first?
Re: Firefox Lockbox
#38I am curious how it works, technically speaking. I already have this capability with password-store (pass), that works for Firefox, Chrome and Safari on destop and mobile. pass - https://www.passwordstore.org (core program) passff - https://github.com/jvenant/passff (firefox desktop) passforios - https://mssun.github.io/passforios (ios w/firefox mobile) qtpass - http://qtpass.org (osx, linux, windows)
OpenKeychain and Password-store (paired with a yubikey) is the entire reason I use Android over iOS. I really wish there was hardware GPG key solution for the iphone.
Re: Firefox Lockbox
#39Earlier quoted context omitted.
Most likely. The iOS guys that work on Mozilla apps are pretty tech savvy and use latest Apple technology.
I appreciate the vote of confidence but I was hoping someone from the team could chime in or someone who took the time to try it out. Based on other comments in this thread it looks like it may just rely heavily on copy/paste.
It’s not a vote of confidence, it’s my professional opinion as an iOS developer.
If push comes to shove, since all Mozilla iOS projects are open source, anyone can add this functionality.
Re: Firefox Lockbox
#40Earlier quoted context omitted.
Most likely. The iOS guys that work on Mozilla apps are pretty tech savvy and use latest Apple technology.
Yes, us guys and gals working on the app are planning on the iOS 12 autofill API integration: https://github.com/mozilla-lockbox/lockbox-ios/issues/445
Keep up the good work! Not surprised you are already considering it.