Can Chrome Sync or Firefox Sync be trusted with sensitive data? (2018) | Hacker News Reader

Can Chrome Sync or Firefox Sync be trusted with sensitive data? (2018)

palant.info

42 pointsc5karl29 comments

Important caveat with Firefox: You can run your own Firefox Account server (see https://mozilla-services.readthedocs.io/en/latest/howtos/run...) and then e.g. connect to it over a VPN to mitigate a lot of this.

Problem with this is that it needs the sync server:

> Since the Mozilla-hosted sync servers will not trust assertions issued by third-party accounts servers, you will also need to run your own sync-1.5 server.

The tutorial refers to the old unmaintained version: https://github.com/mozilla-services/syncserver, see https://github.com/mozilla-services/syncserver/commit/8d9804...

The alternative is https://github.com/mozilla-services/syncstorage-rs which is ridiculously hard to set up.

I got stuck with the new one as well last time I tried. But it seems like there is an docker option now, which seems to make things a lot easier

I've posted on this a few times. Rehashing[0]:

> https://github.com/mozilla-services/syncserver/pull/294

> So basically they stopped running the older version themselves but don't consider the newer version production-ready yet. What a mess.

This doesn't seem to have improved much since...

Some of my experience self-hosting the whole stack previously:

https://news.ycombinator.com/item?id=30315816

https://news.ycombinator.com/item?id=30727935

[0]: https://news.ycombinator.com/item?id=30728966

> The alternative is https://github.com/mozilla-services/syncstorage-rs which is ridiculously hard to set up.

https://github.com/mozilla-services/syncstorage-rs/issues/49...

This is the issue to watch, supporting SQLite. This makes it feasible to run a simple sync server for a single user or a small group. But this is not moving forward.

There are solutions external to the browsers that work pretty well and where you have control on your data :

Floccus for bookmarks (https://floccus.org/) : it works also on mobile devices : a great plus ! You need only a webdav server (or a Nextcloud account), I use Dave (https://github.com/micromata/dave)

Vaultwarden for the passwords (https://github.com/dani-garcia/vaultwarden)

A huge advantage of this solution is that you can have synchronization also between different browsers and on mobile devices.

https://bugzilla.mozilla.org/show_bug.cgi?id=1320222, doesn't seem conclusive to me wrt Firefox Sync safety

This article is from 2018, and contains a single update from 2020. I would think the terrain has shifted in the last 3 years, so take the article with an appropriate pinch of salt.

Digging around there appears to be a newer article (which probably prompted the original thread) is here https://palant.info/2023/08/29/chrome-sync-privacy-is-still-... which has it's own HN thread here

Isn't it somewhat hilarious that the author of Adblock Plus, far and away the largest privacy risk faced by anyone, throws this much shade on Google's privacy protections? ABP gets unfettered, full and complete access to all your data no matter how sensitive and only the publisher's OpSec stands between the user and total exposure.

Google is already in possession and presently selling information on you. Adblockers like basically every piece of poorly segregated software on your system is in a position to compromise your privacy. Both are concerns but one does appear more immediate.

I'm not sure I see the humor? Also not sure how Adblock Plus is far and away the largest privacy risk for anyone?

I'm sympathetic to wanting to limit data access to things. But this data seems to already be available to the browser? Having a separate process to manage that seems somewhat natural?

Note: I am the author of this article.

Every ad blocker gets full and complete access to all your data. It needs that kind of access in order to … tada … remove ads. It’s really simple: ads are on all websites, so an ad blocker needs access to all websites.

You probably mean that Adblock Plus abuses this access? Surely this is something you have proof for? Here you can see an example of how this kind of thing looks like: https://palant.info/2023/06/05/introducing-pcvark-and-their-.... You can look around in my blog, there is more.

It has been a while since I’ve been involved with Adblock Plus. I sincerely doubt however that ABP’s privacy stance changed that much since I’ve left. But I’ll wait for you to find proof for your claims.

> Every ad blocker gets full and complete access to all your data.

Except uBlock Origin Lite¹ which is permission-less.

¹) https://addons.mozilla.org/en-US/firefox/addon/ublock-origin...

Funny thing is: declarative access to websites still allows for plenty of mischief if one wanted to do it. I’ve actually seen malicious extensions abuse that. Browsers might have to revisit the decision to ignore declarative access as far as the permission prompt goes.

> Update (2020-06-10): The issue has been resolved in Chrome 80. The key derivation algorithm used now is scrypt with N=8192, r=8, p=11. These values are sane and should make attacks against most passwords unrealistic.

Note: I am the author of this article.

Yes, they fixed this particular issue (and a few more), the article mentions it. But the update I published today explains why Chrome Sync is still very bad privacy-wise (as opposed to outright horrible which it was back in 2018). https://palant.info/2023/08/29/chrome-sync-privacy-is-still-...

Recent and related:

Google moderates Google Collections items - https://news.ycombinator.com/item?id=37301600 - Aug 2023 (38 comments)

(2018)

2018.

Google/Chrome can't even be trusted with you bookmarks.

https://strangeobject.space/@silvermoon82/110969122337810598

The item that was "moderated" was in a collection, which isn't a bookmark.

https://www.google.com/save/

That's where collections live, and apparently they can be shared.

Not to defend google, for sure. I just wanted to stop the spread of incorrect information.

EDIT: I like many others didn't know about this feature and had no idea what was saved there or how it got there.

Still very pathetic. Google has zero business in interfering in private data seen by no one else. They are providing a service to store things, not to "moderate" or to publish them.

The terminology might have been inaccurate but in spirit, it's the same. It's a disgrace.

That's completely irrelevant to the content of this piece.

This article probably re-submitted, because a recent update to it did not make it to the front page:

https://palant.info/2023/08/29/chrome-sync-privacy-is-still-...

Might be redundant, but it looks like the Chrome devs fixed this issue back in 2020.

https://bugs.chromium.org/p/chromium/issues/detail?id=820976

Note: I am the author of this article.

They fixed this particular issue (and a few more), the article mentions it. But the update I published today explains why Chrome Sync is still very bad privacy-wise (as opposed to outright horrible which it was back in 2018). https://palant.info/2023/08/29/chrome-sync-privacy-is-still-...

> Can [any storage that is not physically in my possession] be trusted with sensitive data?

No. You could make a case for E2E encrypted data where the storage provider does not have keys. That's pretty rare though. The point is, nobody gives a flip about your privacy. As soon as men with guns come asking for your data, any data business will hand it over without hesitation. Men with badges are only very slightly less threatening than men with guns, as everybody knows who the men with guns work for. So if you think anybody or any business is going to die on the hill of protecting your donkey porn collection, you're delusional.

Note: I am the author of this article.

Firefox Sync encrypts all data on the client side before sending it. Chrome Sync can do the same if you know which settings to use. 1Password, Bitwarden, Dashlane – every password manager worth their salt encrypts data locally (LastPass is the only one which failed really badly here). How is this rare and not something we should expect?

Reply on news.ycombinator.com