Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox Lockbox

testpilot.firefox.com

Post reply on HN
Print view View original

71–80 of 156 posts

Re: Firefox Lockbox

#71

Post by bubblethink »

jeena wrote: post #50
awill wrote: post #43

Earlier quoted context omitted.

I use Android, Linux (at home), and Mac (at work). I switched from KeePass because the UI was really bad, it seemed dead, and I really didn't want to move to KeePass 2 (with Mono on Linux). I switched to enpass, and it's been great. It has native Linux/Mac/Windows apps, a solid Android app (with fingerprint support), and there's no subscription. It's perfect for my needs.

The newest kid on the block is KeePassXC https://keepassxc.org

The browser extension leaves a lot to be desired though. I feel that there are a lot of good standalone password managers, but the ones with good browser extensions are far fewer. I'm using bitwarden right now, which so far seems to be the best of the open source ones in terms of usability.

Re: Firefox Lockbox

#72

Post by yborg »

zeveb wrote: post #34
0942v8653 wrote: post #24

Earlier quoted context omitted.

> in-browser password storage is insecure > (If you don't use a master password, which isn't required, I believe?) When using a cloud-synced password vault that lands on the servers of a third party (this includes Firefox, Google, 1Password, Lastpass, etc.) you must always assume that the file itself is compromised; the only thing between an attacker and your passwords is the encryption by your master key. I seriousl…

> I seriously doubt that Firefox Lockbox will allow you to cloud-sync your password file without setting a master password. The current Firefox Accounts protocol simply encrypts a master key with a key derived from the account password. That's not terrible, although it does mean that account passwords must be cryptographically strong. However, Firefox Accounts can be logged into from a webpage which executes JavaScri…

If you are a likely target for a government entity with subpoena power you have much bigger problems than your Firefox Accounts password. The problematical scenario is that Mozilla is remote compromised by some bug or poor opsec and criminal entities will serve compromised JS. Since this has literally happened to basically every kind of organization out there, it is virtually certain to happen to Mozilla.

Re: Firefox Lockbox

#73

Post by davidrusu »

tlb wrote: post #69
davidrusu wrote: post #64

I've been working on this distributed offline-first datastore that uses the Git protocol as the network layer. I'm calling it GitDB (but the Git trademark is getting more strictly enforced these days so that'll need to change). The idea is that we should be able to build tools where the user can understand and manage where data is stored while at the same time keeping many of the conveniences of modern apps, like cro…

Pass ( https://www.passwordstore.org/ ) uses git as a password database in a similar way.

AFAIK pass won't handle conflicts for you (please correct me if I'm wrong!).

This isn't a big problem for a password manager since conflicting changes are very uncommon, but for other apps this starts to get more important.

Re: Firefox Lockbox

#74

Post by zokier »

bonsai80 wrote: post #68

Are Firefox passwords encrypted on the client? I currently use (any pay for) Bitwarden and I like that the code is open and my data is encrypted on the client and only synced with the server. I'd like a similar service from Mozilla, but don't know how the encryption is handled.

If you have master password set in the browser then the password db is encrypted locally. I remember there being some noise about it not being very secure encryption, so better check the details if that is critical for you. As for the Firefox Accounts/Sync stuff, afaik MozCo servers see only encrypted content.

https://medium.com/mozilla-tech/how-firefox-sync-keeps-your-... might provide more insight

Re: Firefox Lockbox

#75

Post by zokier »

com2kid wrote: post #51
walrus01 wrote: post #42

Earlier quoted context omitted.

I specifically use keepassx and v2 format keepass file db, separately, because it is not integrated with any browser via extension or plugin. Keeping things compartmentalized reduces risk in my opinion. And unless I copy the locally stored .kdbx file somewhere manually, it has zero interaction with any network, cloud based service, or third party beyond my control.

I was tired of browser plugins that just didn't always work quite right. Keepass, on whatever platform using whatever client, just uses the clipboard. 100% chance of working, although not safe against certain types of spyware.

> Keepass, on whatever platform using whatever client, just uses the clipboard. 100% chance of working, although not safe against certain types of spyware

On Android the preferred way of using Keepass is with custom keyboard, which protects against clipboard sniffing.

Re: Firefox Lockbox

#76

Post by FullyFunctional »

I installed it and will compare it to Lastpass (which is pretty good IMO). HOWEVER, it saddens me to read on the front page: "using 256-bit encryption". I'd really expect the competent people at Mozilla to know that this statement means next to nothing. At the very minimum I want to know:

1) HOW is the key derived (say, "derived used PBKDF2 on the Firefox username + password")

2) WHERE is it encrypted (I assume "encrypted on the device/end-to-end/zero-knowledge"). It needs to be clear what the attack vectors are.

3) HOW is the secret managed (say, "Secret is wiped on all application switches")

and probably more that I forgot.

Using the app, the first thing I noticed is that I have a LOT of duplicate entries but no obvious way to clean that up.

EDIT: I see most of these details are on https://blog.mozilla.org/services/2014/04/30/firefox-syncs-n... but it doesn't change my disappointment in the totally useless "256-bit encryption" statement. Just say "strong encryption practices" and provide a link to the details. 8,192 bit encryption doesn't help you if you don't manage the key well.

Re: Firefox Lockbox

#77

Post by zebrafish »

Thriptic wrote: post #36

Has anyone done a thoughtful comparison of PW managers? I moved on from keepass because it was a huge hassle to use, but LastPass and 1password both have some detractors as well.

Wirecutter has done a comparison of them.

https://thewirecutter.com/reviews/best-password-managers/

Re: Firefox Lockbox

#78

Post by zokier »

One of the ideas I had once was to build a client for Firefox Sync, either as a plugin for Keepass or as a native standalone application (that could possibly sync with Keepass database). While this does not exactly match such use, it kinda still is a step towards that direction.

Re: Firefox Lockbox

#79

Post by ChrisSD »

FullyFunctional wrote: post #76

I installed it and will compare it to Lastpass (which is pretty good IMO). HOWEVER, it saddens me to read on the front page: "using 256-bit encryption". I'd really expect the competent people at Mozilla to know that this statement means next to nothing. At the very minimum I want to know: 1) HOW is the key derived (say, "derived used PBKDF2 on the Firefox username + password") 2) WHERE is it encrypted (I assume "encr…

I'd guess for that page the technical details get fed to marketing who boil it down to whatever they think will impress people with limited (if any) technical knowledge.

Re: Firefox Lockbox

#80

Post by ldayley »

FullyFunctional wrote: post #76

I installed it and will compare it to Lastpass (which is pretty good IMO). HOWEVER, it saddens me to read on the front page: "using 256-bit encryption". I'd really expect the competent people at Mozilla to know that this statement means next to nothing. At the very minimum I want to know: 1) HOW is the key derived (say, "derived used PBKDF2 on the Firefox username + password") 2) WHERE is it encrypted (I assume "encr…

I, too, want to know the implementaion details. That said I’ve watched hundred of eyes gloss over as I emphatically implored lay-persons about password policies and tools like password managers and Frankly their definition of ‘secure’ can be encapsulated in ‘256-bit encryption’.

An oversight on Mozilla’s part for security-types and engineers, but maybe they have the masses in mind with this tool & it’s marketing site.

Post reply on HN