Hacker News Reader

Comment by arkadiyt | Hacker News Reader

> The party which holds your data is also the party which ships evergreen versions of the software used to decrypt that data. There’s nothing to stop the government in Firefox’s jurisdiction from bullying them into adding a backdoor.

Hosting your own sync server doesn't prevent this.

View on HN

The government can’t bully you into decrypting your own data or releasing your encrypted data without you knowing.

If Firefox is backdoored, as per GP's hypothetical situation, your data can be sent to a sync server other than the one you configured.

The only realistic way to stop it would be to only use a specific audited version of FF. If that's the case then there's no need to use your own sync server because you already know it's not backdoored.

Which government? Because there absolutely are governments that can, UK for example.

The UK government can bully you into telling them things without you knowing you told them those things? That sounds interesting, how does that work?

Oops, misread the “without you knowing” bit.

They can bully the open sourcerer into adding a backdoor to the code, then use that backdoor without you noticing.

There can be no guarantee you’d not notice, but more importantly if you go down that path you can’t trust anything and that is a silly reason to not build defense in depth and not entrust your secrets to the cloud.

Reply on news.ycombinator.com