Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by mrwizardno2 | Hacker News Reader

Full thread

mrwizardno2·

> Mozilla says that they can’t (decrypt my data on their servers), and I trust them.

I don't. I still neuter Firefox (LibreWolf, mostly.) and disable all the sync nonsense.

View on HN

Though even the librewolf maintainers trust mozilla with the encryption

https://librewolf.net/docs/faq/#can-i-use-firefox-sync-with-...

AFAIK Google can't decrypt your Chrome data either (if you've set an optional passphrase).

See https://support.google.com/chrome/answer/165139.

One can self-host the sync server. I do this and it works great across Android and a Linux desktop, including live showing which tabs are open.

What does the storage layer (database) contain? Clear-text, usable data, or encrypted randomness?

Great question! I'd never actually checked, but opening up the SQLite database, it looks encrypted. I see a table `batch_upload_items` full of ciphertexts.

I'm running the old Python sync server for the time being.

It is indeed using end-to-end encryption: https://hacks.mozilla.org/2018/11/firefox-sync-privacy/

Sync can be self-hosted but the equally necessary auth-service is centralised at Mozilla. This does not make sense from a technical perspective and is reason for me to not use Firefox sync. I used to run is predecessor and liked the services it provided so I'd like to run the whole current stack as well but alas.

My understanding is that can be self-hosted as well, it's just slightly more annoying.

Do you consider it to be useless or is it something else? Privacy concerns (it is e2e encrypted btw)?

So, you trust some other random people with your privacy instead then?

Reply on news.ycombinator.com