21–30 of 91 posts
Great timing, with Mozilla's new privacy policy problems the other day
why would those matter since your sync data is encrypted and they can't see it anyway?
I did that for a while, including hosting the auth myself. Then I realized Mozilla is probably one of the few companies I trust with my data, even though it's probably misplaced trust. The sync server is relatively straightforward to setup, but auth is quite more involved. I don't think it's worth it, compared to using the public hosted service
What's the privacy benefit, given that Firefox Sync is E2E encrypted? https://support.mozilla.org/en-US/kb/sync
To best of my awareness, the login page (including JS code) is still served over the Internet, and encryption keys are derived solely from the password. That’s not a good design for something as sensitive as one’s full browser data.
but don't know how adding a key owned by moz would make this more trustworthy
Would be nice if librewolf and WaterFox changed their flow to make it clear that Mozilla's Sync Server is being used, and make it opt in with something like: To sync please select one of the options below: [x] Custom Sync Server: ___________ [ ] Mozilla Sync
LibreWolf is opt in and if you click the checkbox named "Firefox Sync" thinking you're getting some kind of sync that isn't Firefox Sync I don't think there's any UI change that can help you.
I did that for a while, including hosting the auth myself. Then I realized Mozilla is probably one of the few companies I trust with my data, even though it's probably misplaced trust. The sync server is relatively straightforward to setup, but auth is quite more involved. I don't think it's worth it, compared to using the public hosted service
What's the privacy benefit, given that Firefox Sync is E2E encrypted? https://support.mozilla.org/en-US/kb/sync
Earlier quoted context omitted.
Maybe eventually the whole stack can make its way into a docker container with a shell script for config.
Maybe it's just me but having dedicated employee's to manage security is a prerequisite for me; atleast I could point my finger at someone if things happen.
Earlier quoted context omitted.
Maybe eventually the whole stack can make its way into a docker container with a shell script for config.
Maybe it's just me but having dedicated employee's to manage security is a prerequisite for me; atleast I could point my finger at someone if things happen.