5

I'd like to sync my browsing data with multiple devices but I'm sure as hell I don't want to share my data with 3rd parties (whatever they claim). I've read in past that data saved via Firefox Sync are encrypted in a way that prevents Mozilla from decrypting it. I've read few[1] articles[2] about Firefox Sync but I'm still confused as to what prevents Mozilla from decrypting the data.

When I created the account on firefox.com, I entered my password (twice). This password could've been sent to Mozilla's servers. Of course, best practice would be to hash it in JavaScript first, but I haven't checked. The page could do anything so as layman I'm assuming the worst.

Now I'm using this same password to login to Firefox Sync in my browser. So the only secret for Sync is shared with Mozilla. If there was an additional secret on local PC, then loss of the PC would mean I wouldn't be able to decrypt my data, so the password must be the only secret.

So what actually prevents Mozilla from data mining on my private data?

[1] https://blog.mozilla.org/services/2014/04/30/firefox-syncs-new-security-model/

[2] https://medium.com/mozilla-tech/how-firefox-sync-keeps-your-secrets-if-tls-fails-14420d45885c

  • Not sure what you mean: "Of course, best practice would be to hash it in JavaScript first" – multithr3at3d Jun 1 '18 at 2:09
6

There's a really good explanation of the crypto/auth for FxA. Looking at it, it shows that both the authentication key and the private data wrapping key are independently derived from the password in a manner in which it's not possible to derive the wrapping key from the authentication key. So nothing stored on their servers would ever allow them to retrieve kB, which is the key used to store the "Class B" sensitive data, including all sync data.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.