Mozilla adopts plain-vanilla password sign-in for Firefox sync
1–10 of 44 posts
Re: Mozilla adopts plain-vanilla password sign-in for Firefox sync
#2Aah good riddance to the older approach. Its a major fail from UX perspective. The long sync key was ridiculous to type.
Re: Mozilla adopts plain-vanilla password sign-in for Firefox sync
#3I see this as a reaction to the competition they're facing with Google Chrome.
With Google Chrome you log into your Google account. email + password and all is good. It's simple, but fundamentally insecure. Google, NSA and whoever else they partner with can poke at all your data without restriction because it is based on a centralized authentication model.
Firefox always based its sync on a secure model where no data was stored unencrypted at Mozilla's sync-servers. There was no traditional "account" which Mozilla had to validate. You could also chose to use your own sync server. Either way, they can not peek at your data.
You gave Firefox your email and a "password" and from that it generated some private keys used to encrypt the data sent to Mozilla. Private keys which you then had to distribute to other Firefox'es one way or another.
They attempted to ease the pain by having some "pair this device" wizards with 3 simple values you could copy from device A to device B, but in the end it still meant that the superior security came at a cost.
No non-technical people I know use Firefox's sync, but everyone I know who use Chrome also use its sync feature.
When comparing browser, some people literally list out "sync" as thing Chrome does and Firefox doesn't. That tells you a lot about how a simple and in your face implementation can drive adaptation. (I think Chrome's approach is too in-your-face, but that's another discussion.)
I honestly believe Firefox's original model is superior once you get past the initial warts, but I can see why they are making the changes they do.
Re: Mozilla adopts plain-vanilla password sign-in for Firefox sync
#4I see this as a reaction to the competition they're facing with Google Chrome. With Google Chrome you log into your Google account. email + password and all is good. It's simple , but fundamentally insecure. Google, NSA and whoever else they partner with can poke at all your data without restriction because it is based on a centralized authentication model. Firefox always based its sync on a secure model where no dat…
Agreed. I don't use either sync, but I know Firefox's is secure (at least, the old private key one - not sure if that's about to be removed) and would consider it if I had a use case of many browsers, while Google's probably just dumps all my bookmarks etc (even saved passwords, if I saved them in the browser...) onto a google/NSA server.
Re: Mozilla adopts plain-vanilla password sign-in for Firefox sync
#5Will Mozilla be removing the secure sync option or having this one in parallel?
I don't use it myself, but it's definitely worrying to see a secure option being potentially removed in favour of plaintext storage on servers outside the user's control.
Re: Mozilla adopts plain-vanilla password sign-in for Firefox sync
#6Aah good riddance to the older approach. Its a major fail from UX perspective. The long sync key was ridiculous to type.
The long sync key was ridiculous to type.
I always emailed and copy-pasted, but yeah. If you didn't have a device you could "pair" with, it was definitely not user-friendly or accessible to non-technical people.
Re: Mozilla adopts plain-vanilla password sign-in for Firefox sync
#7Aah good riddance to the older approach. Its a major fail from UX perspective. The long sync key was ridiculous to type.
Have an attitude like this and you will never have security or privacy.
Re: Mozilla adopts plain-vanilla password sign-in for Firefox sync
#8Re: Mozilla adopts plain-vanilla password sign-in for Firefox sync
#9Will Mozilla be removing the secure sync option or having this one in parallel? I don't use it myself, but it's definitely worrying to see a secure option being potentially removed in favour of plaintext storage on servers outside the user's control.
I don't think it's stored in plain text, the post was about standard login/password signing in instead of too-complex current mechanism.
Re: Mozilla adopts plain-vanilla password sign-in for Firefox sync
#10Will Mozilla be removing the secure sync option or having this one in parallel? I don't use it myself, but it's definitely worrying to see a secure option being potentially removed in favour of plaintext storage on servers outside the user's control.
I don't think it's stored in plain text, the post was about standard login/password signing in instead of too-complex current mechanism.
If it's a username/password pair, either the data has to be stored in plaintext, or with a key escrowed using the user password, which are not as secure as a private key only known to the user.