Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox Sync actually works

howtogeek.com

Post reply on HN
Print view View original

311–320 of 343 posts

Re: Firefox Sync actually works

#311

Post by jhasse »

marcosdumay wrote: post #75
stavros wrote: post #28

Earlier quoted context omitted.

The sync contents are encrypted between devices. EDIT: After writing this, I realized I should investigate the claim, because new devices are added just by logging in, not by giving them any sort of password.

Logging in includes giving the device a password. There's no off-channel key synchronization. What means that the encryption is only as good as your password. But AFAIK no browser has it anyway, and nearly no sync service.

Brave uses a QR code to exchange the key.

Re: Firefox Sync actually works

#312

Post by jhasse »

yesimahuman wrote: post #50

It’s too bad that Firefox has such a great UX and privacy-focused cloud features like this, yet is being held back by its engine. As a heavy FF user for the last few years it’s become more and more clear that the world just doesn’t care about making sites work on FF and I’m more frequently having to switch to Chrome. My dream is that FF would switch to Chromium while keeping all the great features around the browser…

Try Brave, it also has privacy-focused sync, but uses the Chromium engine.

Re: Firefox Sync actually works

#313

Post by jcalvinowens »

rc_mob wrote: post #135
jcalvinowens wrote: post #121

I switched back to firefox last year and haven't looked back. I still use chrome on another laptop sometimes, the performance difference from my human perspective is literally zero. These days, it's much more common for me to encounter a website that works in firefox but not chrome than the other way around. I actually switched for good when I had to use firefox to file my taxes, because the IRS free self-file site w…

Ad blockers break the websites far more often than any browser compat issues.

One of many reasons I don't use ad blockers :)

Re: Firefox Sync actually works

#314

Post by Vinnl »

yellow_lead wrote: post #286
jvehent wrote: post #224

The most compelling reason to use Firefox Sync is that it is client-side encrypted. Mozilla stores opaque encrypted blobs that it is entirely unable to decrypt. Law enforcement agencies request that data from time to time, hoping to obtain browsing history, only to be turned down thanks to the encryption. (disclaimer: former Mozilla security)

Is this encrypted with a KDF from your password?

The encryption method is detailed here, that might potentially (not sure, as I don't know what KDF is) answer your question: https://hacks.mozilla.org/2018/11/firefox-sync-privacy/

But encryption does depend on your password:

> The crux of the difference in how we designed Firefox Accounts, and Firefox Sync (our underlying syncing service), is that you never send us your passphrase. We transform your passphrase on your computer into two different, unrelated values. With one value, you cannot derive the other. We send an authentication token, derived from your passphrase, to the server as the password-equivalent. And the encryption key derived from your passphrase never leaves your computer.

Re: Firefox Sync actually works

#315

Post by Vinnl »

yencabulator wrote: post #308
jvehent wrote: post #224

The most compelling reason to use Firefox Sync is that it is client-side encrypted. Mozilla stores opaque encrypted blobs that it is entirely unable to decrypt. Law enforcement agencies request that data from time to time, hoping to obtain browsing history, only to be turned down thanks to the encryption. (disclaimer: former Mozilla security)

Chrome Sync is also client-side encrypted, you just need to set the sync password. Settings -> You and Google -> Sync and Google Services -> Encryption options

Somewhat relevant: https://palant.info/2023/08/29/chrome-sync-privacy-is-still-...

Re: Firefox Sync actually works

#316

Post by lelanthran »

flexagoon wrote: post #289
lelanthran wrote: post #287

Earlier quoted context omitted.

> Besides those, I don't understand what I'd want to sync. I think it's useful to sync extensions, and personal configurations. For example, I have a userchrome.css (or something like that) file that, for the news.ycombinator.com domain enforces a maximum width on paragraphs, so that on my really really wide screen I don't get 900 characters per line, I get 78 or so. Without sync, I simply copy the files to the corre…

I don't think Firefox Sync manages userChrome though. I currently manage those files together with the rest of my dotfiles with Chezmoi: https://github.com/flexagoon/dotfiles/blob/main/.chezmoiexte... https://github.com/flexagoon/dotfiles/tree/main/dot_config/f...

> I don't think Firefox Sync manages userChrome though.

Sadly, no. This is one of the bigger QoL features of a modern browser - automatically lock the important CSS declarations for specific domains to make things readable and usable for sites you visit the most.

I use it to make sites readable (like HN), but there's some other things I think you can do.

I mean, if you had a list of ad-serving domains (typically ads are served from a different domain to the content), you could set the ad divs to be invisible in some way (`width: 1px`, for example) and the anti-adblocking javascript wouldn't detect any adblocking going on.

Autoplaying videos bothering you? Set the width and height for all video tags on specific domains to 1px.

With CSS getting every more powerful, it opens up a range of opprtunities.

Re: Firefox Sync actually works

#317

Post by nosslin »

zero0529 wrote: post #187

One of my biggest gripes with Firefox sync is the way they have divided the mobile bookmarks from the pc ones. It makes the ux kinda weird as a lot of the bookmarks I use on my desktop I also use on my phone and vice verca. But when I add a bookmark on my phone it ends in a separate mobile bookmark folder.

This is the number one reason why I can't use Firefox

Re: Firefox Sync actually works

#318

Post by ranguna »

GeoAtreides wrote: post #283
jvehent wrote: post #224

The most compelling reason to use Firefox Sync is that it is client-side encrypted. Mozilla stores opaque encrypted blobs that it is entirely unable to decrypt. Law enforcement agencies request that data from time to time, hoping to obtain browsing history, only to be turned down thanks to the encryption. (disclaimer: former Mozilla security)

Even better, you can host the sync server yourself: https://github.com/mozilla-services/syncstorage-rs

A local server that uses sentry and spanner?

What?

Re: Firefox Sync actually works

#319

Post by nottorp »

nottorp wrote: post #276
chuckadams wrote: post #264

Earlier quoted context omitted.

It’s probably handoff. On chrome I get the extra icon as well, but it also has a phone mini-icon over it and a tooltip saying “from Safari”. You can disable handoff, just goo—er, duckduckgo it

I wonder if i can disable it for all apps but still keep it for calls and texts… Call answering from my laptop is the only thing that ever made me rush out and buy a new iPhone that supported it :)

... but what's it doing in handoff without being told to do so?

Re: Firefox Sync actually works

#320

Post by yellow_lead »

Vinnl wrote: post #314
yellow_lead wrote: post #286

Earlier quoted context omitted.

Is this encrypted with a KDF from your password?

The encryption method is detailed here, that might potentially (not sure, as I don't know what KDF is) answer your question: https://hacks.mozilla.org/2018/11/firefox-sync-privacy/ But encryption does depend on your password: > The crux of the difference in how we designed Firefox Accounts, and Firefox Sync (our underlying syncing service), is that you never send us your passphrase. We transform your passphrase on yo…

Thanks! KDF is key derivation function. Looks like they are using PBKDF2.
Post reply on HN