8

According to Mozilla Sync-new-security-model, Firefox servers are not able to decrypt your sync data without your password. So I figured that, the browser generates a key from your password, encrypts the data and sends it over the wire without the key.

But if I forget my password, I can still recover it, by having firefox send a password reset email. According to this page: ive-lost-my-firefox-sync-account-information, you can't recover your sync password without your email.

  1. How does password reset work?
  2. How is Firefox able to decrypt your data on their servers without your old key and send it back to your browser for syncing?
  3. Does it stores the old key somewhere or is there some weird crypto magic going on?
Improve this question

1 Answer 1

Reset to default
4

The specification says:

Note that, since the forgotten-password client never learns kB, any class-B data will be lost.

NB: kB is the private key.

Here's how it works:

  • You generate a new password
  • A new private key "wrapped" with your new password
  • Your old data is lost

The developers of the protocol assumed that if you lost your password, you would still have a device with the data synced. Therefore your device would re-sync the data from scratch.

If you loose your devices AND your password, you're doomed.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .