31–40 of 44 posts
Edit: the article mentions a Firefox Account is needed to use the Firefox Marketplace too. That's a webapp which I thought would have suited Persona.
Now all my bookmarks, history, passwords and the like will be stored on a centralized server? The decentralization, especially in the wake of the NSA/GCHQ revelations, was one of its main advantages. Sigh. I may well have to turn Firefox sync off then.
b) It's encrypted on the client - that's what the password is used for.
Not Mozilla Persona? Why wouldn't it be suitable for this purpose?
Now all my bookmarks, history, passwords and the like will be stored on a centralized server? The decentralization, especially in the wake of the NSA/GCHQ revelations, was one of its main advantages. Sigh. I may well have to turn Firefox sync off then.
I see this as a reaction to the competition they're facing with Google Chrome. With Google Chrome you log into your Google account. email + password and all is good. It's simple , but fundamentally insecure. Google, NSA and whoever else they partner with can poke at all your data without restriction because it is based on a centralized authentication model. Firefox always based its sync on a secure model where no dat…
This isn't really accurate. The problem with Firefox's current/old sync model is recovery. I.e., users think they're getting their stuff (history, passwords, etc) backed up, but when they lose their device, their data is gone forever, because almost none of them will have bothered to write down the long random string that functioned as their sync key. Also, the pairing was relatively hard to use for "normal" users. I…
I get that the old model is too complicated for most people, but I really like it and am able to handle it just fine. I don't want to trust the NSA, damnit.
I see this as a reaction to the competition they're facing with Google Chrome. With Google Chrome you log into your Google account. email + password and all is good. It's simple , but fundamentally insecure. Google, NSA and whoever else they partner with can poke at all your data without restriction because it is based on a centralized authentication model. Firefox always based its sync on a secure model where no dat…
This isn't really accurate. The problem with Firefox's current/old sync model is recovery. I.e., users think they're getting their stuff (history, passwords, etc) backed up, but when they lose their device, their data is gone forever, because almost none of them will have bothered to write down the long random string that functioned as their sync key. Also, the pairing was relatively hard to use for "normal" users. I…
This hasn't been true in my experience. I can initiate a sync from any previously synced device, so as long as I have one sync'd device available I can still get my data back.
Not Mozilla Persona? Why wouldn't it be suitable for this purpose?
Earlier quoted context omitted.
This isn't really accurate. The problem with Firefox's current/old sync model is recovery. I.e., users think they're getting their stuff (history, passwords, etc) backed up, but when they lose their device, their data is gone forever, because almost none of them will have bothered to write down the long random string that functioned as their sync key. Also, the pairing was relatively hard to use for "normal" users. I…
> ut when they lose their device, their data is gone forever, because almost none of them will have bothered to write down the long random string that functioned as their sync key. Al This hasn't been true in my experience. I can initiate a sync from any previously synced device, so as long as I have one sync'd device available I can still get my data back.
Earlier quoted context omitted.
This isn't really accurate. The problem with Firefox's current/old sync model is recovery. I.e., users think they're getting their stuff (history, passwords, etc) backed up, but when they lose their device, their data is gone forever, because almost none of them will have bothered to write down the long random string that functioned as their sync key. Also, the pairing was relatively hard to use for "normal" users. I…
I really hate that this new model requires trust, whereas the old one did not. Even if I trust Mozilla not to peek, I have to accept that all my data, including all my passwords, now become subpoenable. I get that the old model is too complicated for most people, but I really like it and am able to handle it just fine. I don't want to trust the NSA, damnit.
The main security concern (as far as I can tell, and I'm far from an expert) seems to be that the KDF used in the new protocol is not as strong as the one used in the current Sync protocol.
You should read the link posted in the post you replied to, especially the security analysis. It is quite readable and might allay some of your fears.
What is the 'Firefox Account' the new sync system uses and how does it differ from Persona? Will I need a 'Firefox Account' for other Mozilla services? What about Firefox OS? It seems bizarre to me to have this additional account system while promoting Persona as the system for other people to use. Is Persona abandoned? Edit: the article mentions a Firefox Account is needed to use the Firefox Marketplace too. That's…
For Sync, Persona isn't the right tool for the job. Specifically, Sync needs a human-memorable source of entropy (password), and minimal external dependencies so that recovery meets user expectations. It's possible that Accounts will eventually use Persona for email verification, but the centralized password is unlikely to go away.
Marketplace is in a similar situation, and actually uses a centralized, friendly fork of Persona so that it can proactively force users to re-authenticate before purchases and allow people to use the site before they complete their email verification. Those features might make their way into Persona in the future, but for now it felt better to trim them from Persona and switch Marketplace over to Firefox Accounts.