People who still use Chrome nowadays probably haven't heard of Firefox' tree style tabs plugin.
Private by Design: How We Built Firefox Sync
31–40 of 180 posts
Re: Private by Design: How We Built Firefox Sync
#32This might not align with the goals of Mozilla, but what I would love to see is for Firefox Sync to be extracted so that: - It can be integrated into Google Chrome on desktop operating systems. - It can be provided as a stand-alone app on iOS so that I can: a) “Share” links to this hypothetical stand-alone Sync app from Safari in order to send them to Firefox Sync bookmarks storage. b) Copy username and password from…
Don’t Lockbox and Pocket sync to a Firefox account?
Re: Private by Design: How We Built Firefox Sync
#33Earlier quoted context omitted.
You seem to know a bit about encryption. Which is why it baffles me- how does telegram do this? Does it need a connected device in this way too? So one can upload the encryption key if its lost? If no device is connected, can/how do they do it? If yes, can Firefox copy that way?
Telegram chats by default are not end-to-end encrypted. It does have e2e-encrypted chats as an option, but they're only accessible on one device. So: >how does telegram do this? ...the short answer is they don't.
I was referring to them saving encrypted data on their servers. Isn't that e2e encrypted? If not, does that mean an adversary with access to their database knows my chats?
Re: Private by Design: How We Built Firefox Sync
#34Earlier quoted context omitted.
Telegram chats by default are not end-to-end encrypted. It does have e2e-encrypted chats as an option, but they're only accessible on one device. So: >how does telegram do this? ...the short answer is they don't.
I was referring to them saving encrypted data on their servers. Isn't that e2e encrypted? If not, does that mean an adversary with access to their database knows my chats?
That is not end-to-end encrypted, no. The company has all the information necessary to retrieve your plaintext conversation data. They can (and likely do) encrypt this data at rest within their infrastructure, and they can make it as hard as they want for an individual employee to access this information, but fundamentally you're trusting that their internal controls are sufficient.
Re: Private by Design: How We Built Firefox Sync
#35Earlier quoted context omitted.
Thanks. I've been using Firefox Sync ever since it came out but I don't remember it ever mentioning these risks. I think Firefox should mention this when new users enable sync for the first time. It should also offer users to generate recovery keys when they start using sync and for some time after if they haven't.
There's no risk to your data. It's not like this will delete your local data, the only risk is when doing a password reset in some (fairly rare) cases, which does attempt to make the risk of doing so clear. I don't disagree about recovery keys, they're rather new though, eventually it wouldn't surprise me if we did something like that.
There is a risk if you were relying on sync to be a backup solution (which in the absence of discussing the risk of remote data loss, someone might be tempted to do).
Re: Private by Design: How We Built Firefox Sync
#36This might not align with the goals of Mozilla, but what I would love to see is for Firefox Sync to be extracted so that: - It can be integrated into Google Chrome on desktop operating systems. - It can be provided as a stand-alone app on iOS so that I can: a) “Share” links to this hypothetical stand-alone Sync app from Safari in order to send them to Firefox Sync bookmarks storage. b) Copy username and password from…
The predecessor to FF Sync was the open source Weave which you could self host. It was WebDAV-based I believe. Sadly they deprecated it in favor of FF Sync.
EDIT: Forgot to mention Weave was exciting because you could integrate with other browsers. And there was a Dolphin add-on which did just that.
Re: Private by Design: How We Built Firefox Sync
#37People who still use Chrome nowadays probably haven't heard of Firefox' tree style tabs plugin.
What plugin? What does it do?
Re: Private by Design: How We Built Firefox Sync
#38I like, actually love Firefox. So as a major user I resent them for posting this article, its somewhat inethical when no recent work has been done on sync and they are , as they claim themselves, not willing to touch this code in fear of breaking it. If you are don't understand enough to make changes, maybe don't make an article about itm
This is not true. I work on Firefox Sync full time, as do multiple other engineers. Admittedly, the current version in Desktop/iOS/Android is in a sort of 'maintenance mode' (we still fix bugs, but don't work on new features or actively fix it up). The reason for this is basically that those three versions are entirely separate implementations that share no code (they're also in languages that have integration diffic…
>We're currently rewriting it
...in Rust?
(I kid, although, it's a serious quesiton)
Re: Private by Design: How We Built Firefox Sync
#39Earlier quoted context omitted.
Yes, but it's not the default. From the article: > One could, however, add a second passphrase that is never sent to the server, and encrypt the data using that. Chrome provides this as a non-default option. The average user doesn't have the expertise to know that they have to configure an additional "master password" to keep Google from mining their data for ads.
That is true, defaults are important. Firefox users know that because they have to disable the advertisements that appear in the Firefox new tab page by default. https://prod-cdn.sumo.mozilla.net/uploads/gallery/images/201...
It's interesting that while some could certainly characterize all of that screenshot's "Recommended by Pocket" stories as advertisements, recently they've started showing actual Sponsored Stories advertisements in that spot as well.
Re: Private by Design: How We Built Firefox Sync
#40Earlier quoted context omitted.
This is not true. I work on Firefox Sync full time, as do multiple other engineers. Admittedly, the current version in Desktop/iOS/Android is in a sort of 'maintenance mode' (we still fix bugs, but don't work on new features or actively fix it up). The reason for this is basically that those three versions are entirely separate implementations that share no code (they're also in languages that have integration diffic…
>We're currently rewriting it ...in Rust? (I kid, although, it's a serious quesiton)