7

I'd like to sync my browsing data with multiple devices but I'm sure as hell I don't want to share my data with 3rd parties (whatever they claim). I've read in past that data saved via Firefox Sync are encrypted in a way that prevents Mozilla from decrypting it. I've read few[1] articles[2] about Firefox Sync but I'm still confused as to what prevents Mozilla from decrypting the data.

When I created the account on firefox.com, I entered my password (twice). This password could've been sent to Mozilla's servers. Of course, best practice would be to hash it in JavaScript first, but I haven't checked. The page could do anything so as layman I'm assuming the worst.

Now I'm using this same password to login to Firefox Sync in my browser. So the only secret for Sync is shared with Mozilla. If there was an additional secret on local PC, then loss of the PC would mean I wouldn't be able to decrypt my data, so the password must be the only secret.

So what actually prevents Mozilla from data mining on my private data?

[1] https://blog.mozilla.org/services/2014/04/30/firefox-syncs-new-security-model/

[2] https://medium.com/mozilla-tech/how-firefox-sync-keeps-your-secrets-if-tls-fails-14420d45885c

Improve this question
1
  • 1
    Not sure what you mean: "Of course, best practice would be to hash it in JavaScript first"
    – multithr3at3d
    Commented Jun 1, 2018 at 2:09

1 Answer 1

Reset to default
9

There's a really good explanation of the crypto/auth for FxA. Looking at it, it shows that both the authentication key and the private data wrapping key are independently derived from the password in a manner in which it's not possible to derive the wrapping key from the authentication key. So nothing stored on their servers would ever allow them to retrieve kB, which is the key used to store the "Class B" sensitive data, including all sync data.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .