People who still use Chrome nowadays probably haven't heard of Firefox' tree style tabs plugin.
What plugin? What does it do?
I'd love to know, I've never stopped using Firefox and idk what plugin they mean.
Private by Design: How We Built Firefox Sync
41–50 of 180 posts
Re: Private by Design: How We Built Firefox Sync
#42I’ve been using Firefox since I heard about their containers. I’m happy they are pushing for all these privacy tools. For me these are the features that will make me chose over chrome.
ever since they've switched to the quantum engine it also feels really fast, almost faster than chrome with the exception of youtube, which feels sluggish sadly.
That's because YouTube uses non standard HTML features that only work in chrome and then polyfills it for every other browser so it works like shit unless you use chrome.
Re: Private by Design: How We Built Firefox Sync
#43People who still use Chrome nowadays probably haven't heard of Firefox' tree style tabs plugin.
What plugin? What does it do?
Instead of tabs on the top of the window you get them along the side of the window which left you have about 10x more tabs open while still being able to read the names for all of them.
I have been using it for years and would never use a browser without it.
Re: Private by Design: How We Built Firefox Sync
#44Sadly, I believe that Firefox Accounts — upon which Firefox Sync is built — are insecure in execution. The security of the whole system relies on keeping your password secret from Mozilla, but as you can see when accessing https://accounts.firefox.com/oauth/signin?scope=profile&clie... your browser downloads the JavaScript it will use to derive your authentication token from Mozilla.
There’s nothing stopping Mozilla from serving all users malicious JavaScript which sends the password in plaintext; there’s nothing stopping Mozilla from serving 1% of users, or even a single targeted user. They could be forced to do so by a government with control over them; presumably some number of their employees could likewise be suborned by a state or criminal enterprise.
This should all be done by code compiled into the browser and triggered from the UI, rather than JavaScript run within a web page. Yes, Mozilla could also serve malicious Firefox binaries, or even publish malicious Firefox source, but the odds of someone in the world noticing that are significantly higher than a single targeted individual or small number of targeted individuals noticing.
Or maybe I’m missing something? I don’t think I am, though: that Firefox Account page is just HTML served from accounts.firefox.com; it’d be easy enough to just make it a simple form submission and capture the user’s password. And with the password, the security of the system fails completely: it’s simplicity itself to decrypt all stored data with it.
Re: Private by Design: How We Built Firefox Sync
#45Earlier quoted context omitted.
What plugin? What does it do?
I'd love to know, I've never stopped using Firefox and idk what plugin they mean.
Probably this one [0], though I dislike the branding at the top of the sidebar and the fact that since FF lacks native support, you'll still have tabs on top of the window.
[0]: https://addons.mozilla.org/en-US/firefox/addon/tree-style-ta...
Re: Private by Design: How We Built Firefox Sync
#46Earlier quoted context omitted.
I'd love to know, I've never stopped using Firefox and idk what plugin they mean.
Probably this one [0], though I dislike the branding at the top of the sidebar and the fact that since FF lacks native support, you'll still have tabs on top of the window. [0]: https://addons.mozilla.org/en-US/firefox/addon/tree-style-ta...
It used not to be like that but the last versions of Firefox have messed up pretty hard with it.
Re: Private by Design: How We Built Firefox Sync
#47This might not align with the goals of Mozilla, but what I would love to see is for Firefox Sync to be extracted so that: - It can be integrated into Google Chrome on desktop operating systems. - It can be provided as a stand-alone app on iOS so that I can: a) “Share” links to this hypothetical stand-alone Sync app from Safari in order to send them to Firefox Sync bookmarks storage. b) Copy username and password from…
Aren't both Chrome and Firefox's sync protocols open? At least, the Firefox Sync server is still self-hostable and open source, and at least the client side of Chrome's sync is open source since Chromium can sync as well...
I've never understood why someone didn't implement a Firefox Sync extension for Chrome or vice-versa. Is it technical or are people opinionated enough about browsers that no one has the personal need to develop such extensions?
Re: Private by Design: How We Built Firefox Sync
#48Sadly, I believe that Firefox Accounts — upon which Firefox Sync is built — are insecure in execution. The security of the whole system relies on keeping your password secret from Mozilla, but as you can see when accessing https://accounts.firefox.com/oauth/signin?scope=profile&clie... your browser downloads the JavaScript it will use to derive your authentication token from Mozilla. There’s nothing stopping Mozilla…
If you have that much distrust you shouldn't run Firefox at all since every page you load would be at risk. I doubt that any browser would match such an high bar
Re: Private by Design: How We Built Firefox Sync
#49Sadly, I believe that Firefox Accounts — upon which Firefox Sync is built — are insecure in execution. The security of the whole system relies on keeping your password secret from Mozilla, but as you can see when accessing https://accounts.firefox.com/oauth/signin?scope=profile&clie... your browser downloads the JavaScript it will use to derive your authentication token from Mozilla. There’s nothing stopping Mozilla…
If you have that much distrust you shouldn't run Firefox at all since every page you load would be at risk. I doubt that any browser would match such an high bar
There was a substantive suggestion for improvement... to include the javascript calls to grab the authentication inside the source code, rather than a remote call.
Maybe an intermediate solution would be to use integrity hashes on the remote calls.
Re: Private by Design: How We Built Firefox Sync
#50Earlier quoted context omitted.
Probably this one [0], though I dislike the branding at the top of the sidebar and the fact that since FF lacks native support, you'll still have tabs on top of the window. [0]: https://addons.mozilla.org/en-US/firefox/addon/tree-style-ta...
It used not to be like that but the last versions of Firefox have messed up pretty hard with it.
[deleted]