Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Private by Design: How We Built Firefox Sync

hacks.mozilla.org

Post reply on HN
Print view View original

81–90 of 180 posts

Re: Private by Design: How We Built Firefox Sync

#81

Post by hnaccy »

rfk wrote: post #61
rauhl wrote: post #44

Sadly, I believe that Firefox Accounts — upon which Firefox Sync is built — are insecure in execution. The security of the whole system relies on keeping your password secret from Mozilla, but as you can see when accessing https://accounts.firefox.com/oauth/signin?scope=profile&clie... your browser downloads the JavaScript it will use to derive your authentication token from Mozilla. There’s nothing stopping Mozilla…

Hi, Firefox Accounts developer here. You're correct in your understanding that that login flow is ultimately driven by a webpage, and this is a deliberate trade-off that we made in the interests of reach and usability of the system. It's certainly a trade-off that not everyone is comfortable with, but we're confident it's the right one for the majority of our users. You can read some previous discussions on the topic…

>The reason the login form is delivered as web content is to increase development speed and agility

You saved some sprints but invalidated the purpose of the project. Very agile.

>Ultimately I think we can have web content from accounts.firefox.com be just as trustworthy as, say, a Mozilla-developed addon which might ship in the browser by default, which is a pretty high bar. We're not there yet, but it seems worth pursuing to try to get the best of both worlds.

The safety of the default installation is crowdsourced across all users and can't be targeted. The safety of the JS I load from Mozilla is not and I would have to verify its safety every time. Unless I'm misunderstanding something it can never be as trustworthy.

Re: Private by Design: How We Built Firefox Sync

#83

Post by Benjamin_Dobell »

hnaccy wrote: post #81
rfk wrote: post #61

Earlier quoted context omitted.

Hi, Firefox Accounts developer here. You're correct in your understanding that that login flow is ultimately driven by a webpage, and this is a deliberate trade-off that we made in the interests of reach and usability of the system. It's certainly a trade-off that not everyone is comfortable with, but we're confident it's the right one for the majority of our users. You can read some previous discussions on the topic…

>The reason the login form is delivered as web content is to increase development speed and agility You saved some sprints but invalidated the purpose of the project. Very agile. >Ultimately I think we can have web content from accounts.firefox.com be just as trustworthy as, say, a Mozilla-developed addon which might ship in the browser by default, which is a pretty high bar. We're not there yet, but it seems worth p…

How did you install Firefox in the first place?

Re: Private by Design: How We Built Firefox Sync

#84

Post by qbaqbaqba »

Benjamin_Dobell wrote: post #83
hnaccy wrote: post #81

Earlier quoted context omitted.

>The reason the login form is delivered as web content is to increase development speed and agility You saved some sprints but invalidated the purpose of the project. Very agile. >Ultimately I think we can have web content from accounts.firefox.com be just as trustworthy as, say, a Mozilla-developed addon which might ship in the browser by default, which is a pretty high bar. We're not there yet, but it seems worth p…

How did you install Firefox in the first place?

Dist repo?

Re: Private by Design: How We Built Firefox Sync

#85

Post by hnaccy »

Benjamin_Dobell wrote: post #83
hnaccy wrote: post #81

Earlier quoted context omitted.

>The reason the login form is delivered as web content is to increase development speed and agility You saved some sprints but invalidated the purpose of the project. Very agile. >Ultimately I think we can have web content from accounts.firefox.com be just as trustworthy as, say, a Mozilla-developed addon which might ship in the browser by default, which is a pretty high bar. We're not there yet, but it seems worth p…

How did you install Firefox in the first place?

You can verify hash with others or compile it yourself.

Re: Private by Design: How We Built Firefox Sync

#86

Post by IshKebab »

rauhl wrote: post #44

Sadly, I believe that Firefox Accounts — upon which Firefox Sync is built — are insecure in execution. The security of the whole system relies on keeping your password secret from Mozilla, but as you can see when accessing https://accounts.firefox.com/oauth/signin?scope=profile&clie... your browser downloads the JavaScript it will use to derive your authentication token from Mozilla. There’s nothing stopping Mozilla…

If Mozilla wants your passwords there's nothing to stop them adding code to Firefox itself that detects when you are typing your password in and sends it to them. It could be limited to just you in that case too.

This is really to protect against two things:

1. Legal requests for your data. It's actually not really been tested whether or not the government can force an entity to insert a backdoor for a specific user or not. I think everyone hopes that can't do that but does anyone really know?

2. Data breaches.

Re: Private by Design: How We Built Firefox Sync

#87

Post by lorenzhs »

codetrotter wrote: post #30

This might not align with the goals of Mozilla, but what I would love to see is for Firefox Sync to be extracted so that: - It can be integrated into Google Chrome on desktop operating systems. - It can be provided as a stand-alone app on iOS so that I can: a) “Share” links to this hypothetical stand-alone Sync app from Safari in order to send them to Firefox Sync bookmarks storage. b) Copy username and password from…

Check out https://lockbox.firefox.com/, which is an iOS app that syncs with Firefox Sync, and integrates with the iOS 12 password management interface. It doesn't do bookmarks, but it should fulfill part "b)" of your requirements nicely. It's still in Beta according to https://testpilot.firefox.com/experiments/firefox-lockbox but it works very well for me.

Re: Private by Design: How We Built Firefox Sync

#88

Post by Benjamin_Dobell »

hnaccy wrote: post #85
Benjamin_Dobell wrote: post #83

Earlier quoted context omitted.

How did you install Firefox in the first place?

You can verify hash with others or compile it yourself.

Did you personally, and at least one other trusted party, sign off on every single commit, or are you trusting Mozilla?

Where did you get the hash you're comparing against?

Firstly, no matter what you're trusting the developers of the software you're running on your computer.

Secondly, the software (and/or its hash), just like this JavaScript, is delivered to you in a verifiably secure fashion i.e. SSL.

What's the difference?

Sure, this JS can change. Do you have automatic updates running for Firefox, or any piece of software on your computer?

Re: Private by Design: How We Built Firefox Sync

#90

Post by Fnoord »

drdaeman wrote: post #69
arctux wrote: post #3

This is a good example of why Firefox is so important. Mozilla's incentives, unlike those of companies making significant revenue from tracking-based advertising, align with the user. Google, for example, could have implemented Chrome's sync feature in a privacy preserving manner, but instead chose to use it as a method to collect their users' complete browsing histories.

If that's the case why Firefox Accounts is not really designed with the end-user in mind? The design totally looks like a nice walled garden, completely custom and non-interoperable. Just a few quick examples: 1. There's HAWK and OAuth2 and BrowserID there, all in the same system. That's a lot of undesirable extra complexity. 2. The Sync 1.5 protocol itself is full of non-standard weirdness, with odd stuff like X-Las…

Keep in mind Weave was designed as the alternative to using LDAP for storing such information. The first browser supporting Firefox Sync (Weave) was Fennec on Nokia N8x0/N900. We're talking about 2008 or so here. LDAP is no longer used for this purpose, and the other alternative is proprietary and stores your data at a third party for data mining (Google Chrome).
Post reply on HN