Hacker News Reader

Comment by windsurfer | Hacker News Reader

I want to use Sync, but I'm really concerned with the security of it. How do I know my data is safe?

Can I install a sync server on my own domain?

Data is encrypted client-side, so even Mozilla can't read it. If someone hacks Mozilla, they could get your encrypted data, but without your passphrase, they won't be able to read it. On the downside, if you forget your passphrase, you won't be able to read your data either (you have to wipe your account and start over).

Are you sure? According to this: https://wiki.mozilla.org/Labs/Weave/Sync/1.1/Setup it says the passphrase you use is sent in the clear (over HTTPS) to mozilla every time you get the data. That implies that while the data may be stored encrypted client-side, it's decrypted or at least verified server-side.

That is an old page, back when it was a labs project called Weave.

Try this: http://support.mozilla.com/en-US/kb/what-firefox-sync#w_what...

There is absolutely no way for Mozilla to get your data, even if subpoenaed. And, if for some reason you still don't trust it, you can easily set it up on your own server.

Okay, how do I set it up on my own server? If that link is old, where's the updated one?

>>There is absolutely no way for Mozilla to get your data, even if subpoenaed

There needs to be more assurances like this in the world.

The encryption key and the password are two separate tokens. The password is supplied by the user, while the encryption key is a randomly-generated 26-character string. (In some earlier versions of Firefox Sync, the key was also supplied by the user and was called a "secret phrase.")

The password is sent to the server, but the encryption key is not. For more info, see: https://support.mozilla.com/kb/where-can-i-find-my-firefox-s...

You can.

Source code: http://hg.mozilla.org/services/sync-server Instructions: https://wiki.mozilla.org/Labs/Weave/Sync/1.1/Setup

Wow, thanks. That looks a little too complicated for me, though.

Edit: Also the link seems to be outdated.

That page is reasonably up to date. Also, there's an alternate server in PHP which is easier to set up:

http://tobyelliott.wordpress.com/2011/03/25/updating-and-dep...

The PHP "minimal" server is going away in the future, as the Python server becomes better-supported and easier to set up. For now, however, the minimal server is usable and current; the latest version was released just last week.

That's not what you should use (though it's what is currently used in production at Mozilla). There's a reimplementation in Python; the README: http://hg.mozilla.org/services/server-full/file/db2d0dbc0a79...

(The Python implementation will eventually replace the PHP implementation in production as well.)

Reply on news.ycombinator.com