Hacker News Reader

Comment by arkadiyt | Hacker News Reader

> However, I do not want to risk storing absolutely sensitive data (browsing history, auth cookies, credentials, etc) at some third party.

FWIW Firefox says they do not have the capability to read your data: https://hacks.mozilla.org/2018/11/firefox-sync-privacy/

View on HN

Unfortunately, this isn’t really true. The party which holds your data is also the party which ships evergreen versions of the software used to decrypt that data. There’s nothing to stop the government in Firefox’s jurisdiction from bullying them into adding a backdoor. We can assume the bullying is ongoing.

I like to imagine it as having a safe deposit box provided by a local bank. I have the only key and have proven that to be the case. I also store the key at home in another safe which is regularly serviced by bank employees. While they probably don’t abuse their position in the latter to access the former, it would be completely wrong to say they do not have the capability to get at my stuff.

All that aside, I love FF sync and rely on it everyday for work stuff. It is like magic and I’m very grateful for the feature. I am realistic about the NSA’s level of interest in my work calendar and the threat they pose to my day to day life.

> The party which holds your data is also the party which ships evergreen versions of the software used to decrypt that data. There’s nothing to stop the government in Firefox’s jurisdiction from bullying them into adding a backdoor.

Hosting your own sync server doesn't prevent this.

The government can’t bully you into decrypting your own data or releasing your encrypted data without you knowing.

If Firefox is backdoored, as per GP's hypothetical situation, your data can be sent to a sync server other than the one you configured.

The only realistic way to stop it would be to only use a specific audited version of FF. If that's the case then there's no need to use your own sync server because you already know it's not backdoored.

Which government? Because there absolutely are governments that can, UK for example.

The UK government can bully you into telling them things without you knowing you told them those things? That sounds interesting, how does that work?

Oops, misread the “without you knowing” bit.

They can bully the open sourcerer into adding a backdoor to the code, then use that backdoor without you noticing.

There can be no guarantee you’d not notice, but more importantly if you go down that path you can’t trust anything and that is a silly reason to not build defense in depth and not entrust your secrets to the cloud.

> I have the only key and have proven that to be the case

Locksmiths will get through that lock in a couple of minutes, probably without you ever knowing

The only thing stopping the bank and/or government from accessing your box is the law

This is what I learned over the years after my techno fantasies were confronted with the real world. Technology can give you good protections to make blanket or mass interference on people’s affairs costly, but the illusion of safety it gives is over emphasised.

A very motivated actor will just knock on your door and ask you for the key(digital or otherwise) at gun point and it is game over.

Like one of the replies above, model your threat and enjoy like free of paranoia. It is a beautiful world out there! Ah and be politically active so your representatives preserve common freedom and well being.

And we all know from Snowden/Assange how effective that is.

Then you can’t trust the FF code not to send a copy to their own servers also.

Why would you need to trust it? Just block access to their servers on your network.

Anyone _that_ concerned can operate a whitelist-only policy on their network, now nothing goes anywhere they don't want it to.

White-listing what addresses a web browser can reach seems to go against the intended use - you know, to browse the web.

Edit: Also, I don't think this is as much about trust as it is about avoiding being part of the huge target that the centrally hosted Firefox Sync servers must be.

While Firefox developers and Mozilla might be wholly trustworthy, they might become compromised by some configuration error or zero day vulnerability. So someone might steal the sweet sweet treasure that is in the Sync servers. Now, that is encrypted of course, but they might have made a simple error[1] in how encryption is implemented and the encryption may be defeated.

[1]: See for example: https://www.schneier.com/blog/archives/2008/05/random_number...

> White-listing what addresses a web browser can reach seems to go against the intended use - you know, to browse the web.

Agreed, but that was an extreme example. Blocking FFs known addresses should be sufficient with some additional network monitoring just in case.

I can't response to the rest of your comment, as my point was specifically about not needing to trust FF/MZ if you're running your own sync server. Once the software is within your network, it is entirely up to you, your tools and your skills to determine what does and does not leave it and to where.

If you have something you are that concerned about then you should whitelist everything. Note that the whitelist needs to be one both sides, the server and the users. This along with lots of other security protections, some of which are a lot stronger than a whitelist.

Instead of directly exposing the server to the internet, you could keep it behind a VPN. That way you only need to keep the VPN secure, the VPN serves as a whitelist.

Banks always drill out the lock on a safe deposit box if they need to get in, even though it wouldn't be hard for someone to pick the lock (or so lockpicks who claim to have the ability to check this say, I've never tried to pick the lock on a safe deposit box, and my lockpick skills are not very good so I doubt I could)

> FWIW Firefox says they do not have the capability to read your data: https://hacks.mozilla.org/2018/11/firefox-sync-privacy/

The article is from 2018. Isn't this only relating to the old version of Firefox Sync - the one in which self-hosting is actually supported?

The design looks reasonable. However, my main problem with it is that putting all this extremely valuable data in one place makes it a huge target. A supply-chain attack or an implementation error in the crypto would be devastating.

That's also an option in Chrome, "encrypt sync data with your own sync passphrase"

Reply on news.ycombinator.com