Private by Design: How We Built Firefox Sync
hacks.mozilla.org
Private by Design: How We Built Firefox Sync
1–10 of 180 posts
Re: Private by Design: How We Built Firefox Sync
#2I’ve been using Firefox since I heard about their containers. I’m happy they are pushing for all these privacy tools. For me these are the features that will make me chose over chrome.
Re: Private by Design: How We Built Firefox Sync
#3This is a good example of why Firefox is so important. Mozilla's incentives, unlike those of companies making significant revenue from tracking-based advertising, align with the user. Google, for example, could have implemented Chrome's sync feature in a privacy preserving manner, but instead chose to use it as a method to collect their users' complete browsing histories.
Re: Private by Design: How We Built Firefox Sync
#4How does Firefox Sync handle a user changing their password? What if the password is changed from another device? Does it force users to first sign in with old password and only then allow to change it, essentially re-encrypting everything and syncing again? If so, does that mean forgetting the password equals to losing all synced data?
Re: Private by Design: How We Built Firefox Sync
#5This is a really great article. The level of detail is perfect. I feel that I could implement a similar encryption system as a proof of concept after reading it. It seems so obvious but it really does go against the grain of many of the more common approaches (as explained in the article) because respecting the privacy of a user is so unusual.
Re: Private by Design: How We Built Firefox Sync
#6This is a good example of why Firefox is so important. Mozilla's incentives, unlike those of companies making significant revenue from tracking-based advertising, align with the user. Google, for example, could have implemented Chrome's sync feature in a privacy preserving manner, but instead chose to use it as a method to collect their users' complete browsing histories.
Doesn't chrome lets you use your own encryption key?
Re: Private by Design: How We Built Firefox Sync
#7How does Firefox Sync handle a user changing their password? What if the password is changed from another device? Does it force users to first sign in with old password and only then allow to change it, essentially re-encrypting everything and syncing again? If so, does that mean forgetting the password equals to losing all synced data?
Yes, sort of (more about the process: https://github.com/mozilla/fxa-auth-server/wiki/onepw-protoc...). Key difference: you don't need to sync all the data up again, since there's a separate key for that, which doesn't change.
That said, if you forget your password you do lose remote synced data. The hope is that you have at least one device connected that still has the data, which will upload it in that case. This doesn't work in all cases (there's a pretty common and unfortunate pattern where someone reinstalls their OS, doesn't remember their password, and loses data as a result)
You can also generate and store a separate recovery key to help avoid data loss, https://support.mozilla.org/en-US/kb/reset-your-firefox-acco....
Re: Private by Design: How We Built Firefox Sync
#8This is a good example of why Firefox is so important. Mozilla's incentives, unlike those of companies making significant revenue from tracking-based advertising, align with the user. Google, for example, could have implemented Chrome's sync feature in a privacy preserving manner, but instead chose to use it as a method to collect their users' complete browsing histories.
Doesn't chrome lets you use your own encryption key?
It already encrypts sync data with your G username/password, but you can choose to change it in settings. Chrome 69 or 70 made it even easier to change it right from the settings.
Re: Private by Design: How We Built Firefox Sync
#9I like, actually love Firefox. So as a major user I resent them for posting this article, its somewhat inethical when no recent work has been done on sync and they are , as they claim themselves, not willing to touch this code in fear of breaking it. If you are don't understand enough to make changes, maybe don't make an article about itm
Re: Private by Design: How We Built Firefox Sync
#10This is a good example of why Firefox is so important. Mozilla's incentives, unlike those of companies making significant revenue from tracking-based advertising, align with the user. Google, for example, could have implemented Chrome's sync feature in a privacy preserving manner, but instead chose to use it as a method to collect their users' complete browsing histories.
Doesn't chrome lets you use your own encryption key?
Yes, but it's not the default. From the article:
> One could, however, add a second passphrase that is never sent to the server, and encrypt the data using that. Chrome provides this as a non-default option.
The average user doesn't have the expertise to know that they have to configure an additional "master password" to keep Google from mining their data for ads.