Is the firefox lockbox for hot stocks?
Firefox Lockbox
81–90 of 156 posts
Re: Firefox Lockbox
#82Earlier quoted context omitted.
I specifically use keepassx and v2 format keepass file db, separately, because it is not integrated with any browser via extension or plugin. Keeping things compartmentalized reduces risk in my opinion. And unless I copy the locally stored .kdbx file somewhere manually, it has zero interaction with any network, cloud based service, or third party beyond my control.
I was tired of browser plugins that just didn't always work quite right. Keepass, on whatever platform using whatever client, just uses the clipboard. 100% chance of working, although not safe against certain types of spyware.
It's not all clipboard based - Keepass has an RPC plugin that can be used with browser extensions for Firefox and Chrome. I also use Keepass2android for (duh) Android, and while you can use copy/paste it also has a custom keyboard you can use instead.
Re: Firefox Lockbox
#83I installed it and will compare it to Lastpass (which is pretty good IMO). HOWEVER, it saddens me to read on the front page: "using 256-bit encryption". I'd really expect the competent people at Mozilla to know that this statement means next to nothing. At the very minimum I want to know: 1) HOW is the key derived (say, "derived used PBKDF2 on the Firefox username + password") 2) WHERE is it encrypted (I assume "encr…
I'd guess for that page the technical details get fed to marketing who boil it down to whatever they think will impress people with limited (if any) technical knowledge.
Exactly that, but shouldn't we expect better from Mozilla?
Re: Firefox Lockbox
#84I'm disappointed.
Instead of making password management modular, so any password manager capable of certain queries and operations (KeePass, LastPass, Bitwarden, KWallet/Gnome Keyring/libsecret, Microsoft Credentials Management API, Apple Keychain, etc) could become a storage backend with some programming effort... they're doing the exact opposite - they've created yet another password manager UI and yet another proprietary data format (Lockbox Data Storage) for that purpose.
Seriously, I doubt many (if anyone) but Mozilla management needs or wants a Mozilla-branded extra ecosystem, in addition to Google, Apple and Microsoft-branded ones - yet another piece of software that doesn't interoperate with anything but its own unique data formats and protocols.
I don't know what others want, but I want a good browser that I can hook up with things I already use.
Re: Firefox Lockbox
#85Are Firefox passwords encrypted on the client? I currently use (any pay for) Bitwarden and I like that the code is open and my data is encrypted on the client and only synced with the server. I'd like a similar service from Mozilla, but don't know how the encryption is handled.
as others have said, it's encrypted if you enable the "master password" option; however, the ux of the master password is miserable:
* the prompt for entering your master password is a simple dialog, with "ok" and "cancel" buttons. a website could probably trigger an identical prompt with javascript to phish your master password.
* the prompt pops up once when you first start the browser (about 15-30 seconds after everything is loaded) and then (if you dismiss it with "cancel") again each time you visit a site for which you have a saved password. there's no way to trigger the unlock prompt on-demand.
* the master password doesn't have a timeout. once you've unlocked the keychain, it remains unlocked until you restart the browser.
don't bother. stick with whatever third-party extension you're using.
Re: Firefox Lockbox
#86Earlier quoted context omitted.
> I seriously doubt that Firefox Lockbox will allow you to cloud-sync your password file without setting a master password. The current Firefox Accounts protocol simply encrypts a master key with a key derived from the account password. That's not terrible, although it does mean that account passwords must be cryptographically strong. However, Firefox Accounts can be logged into from a webpage which executes JavaScri…
If you are a likely target for a government entity with subpoena power you have much bigger problems than your Firefox Accounts password. The problematical scenario is that Mozilla is remote compromised by some bug or poor opsec and criminal entities will serve compromised JS. Since this has literally happened to basically every kind of organization out there, it is virtually certain to happen to Mozilla.
The problem is that Mozilla is aware about the issue for years, yet is not doing anything about it, even though the auth protocol is stable and documented. Okay, I get it that they may not want to rewrite already working parts of the browser - but even in this new Lockbox project they're using a WebView to log in to FxA.
Maybe they're already breached by highest-profile actors like NSA?
Re: Firefox Lockbox
#87Can't believe they didn't call it Lockfox.
Re: Firefox Lockbox
#88I installed it and will compare it to Lastpass (which is pretty good IMO). HOWEVER, it saddens me to read on the front page: "using 256-bit encryption". I'd really expect the competent people at Mozilla to know that this statement means next to nothing. At the very minimum I want to know: 1) HOW is the key derived (say, "derived used PBKDF2 on the Firefox username + password") 2) WHERE is it encrypted (I assume "encr…
I, too, want to know the implementaion details. That said I’ve watched hundred of eyes gloss over as I emphatically implored lay-persons about password policies and tools like password managers and Frankly their definition of ‘secure’ can be encapsulated in ‘256-bit encryption’. An oversight on Mozilla’s part for security-types and engineers, but maybe they have the masses in mind with this tool & it’s marketing site…
Maybe the ship has sailed, but I would prefer laypersons not associate the phrase "256-bit encryption" with anything, and would much rather one like "strong encryption practices" if it's a link to the technical specifications. They have no basis on which to evaluate what 256 bits of anything actually mean, so using it as a technical term to throw at their face intending for them to latch onto it as a valuable metric is actively harmful. What if it said "Strong 256-bit RSA encryption". To you and I that phrase should send off alarm bells, but a layperson might actually rank that as more secure because of the added technical jargon. You've just taught them to trust random technical-sounding security jargon so adding more jargon makes it sound more better.
It's probably way to late to make any difference here, but I still wish mozilla could push the boundaries here.
Re: Firefox Lockbox
#89I was under the impression that the password manager for Firefox had some security issues.
Yes, that's why it's not using it. It's only importing from it. Firefox password manager is also getting a revamping, which probably is a sister project to this one.
Thanks for the thoughtful reply
Re: Firefox Lockbox
#90If this is any good I'll be considering it as a replacemnt for Keepass. A bit off topic, but while looking at this I noticed another expirement - Firefox Side View. It looks like it lets you have two open tabs side-by-side in one browser window. This is exactly why I used the Tile Tabs[0] extension and had to switch to Tile Tabs WE[1] with the Quantum update. I'm happy to see this coming back without the WE workaroun…
Link for the curious https://testpilot.firefox.com/experiments/side-view/