Hacker News Reader

It's always a good time to remember that the Firefox Sync data is encrypted with the Mozilla account password, so every further usage of the Mozilla account they introduce is another chance for someone (Mozilla or law enforcement) to gain the ability of decrypting that data.

View on HN

The earlier version of their sync protocol, Weave, only had local encryption. If you forgot the encryption password you lost your sync data with no possibility of recovery. Pale Moon remains the only browser sticking to the older version of sync, although it doesn't have a mobile version anymore and syncing would only make sense between 2 or more PCs.

But your Firefox Account password is never sent to the server.

(Although the code that does the auth does come live from the server which is a notable weakness)

The code that asks you the password comes from the server, and incredibly that's even for logging in to Firefox (and even many years after it's been introduced).

That means that the password and key can be obtained whenever a Mozilla server wants.

It's at this point impossible to believe it wasn't done like that on purpose (after pressure from someone); there's absolutely no reason to do and keep doing something like that other than to secure the ability to look at that data

Reply on news.ycombinator.com