Hacker News Reader

Comment by simfree | Hacker News Reader

Firefox password sync just works. It's one of those things I never think about.

Watching friends and family struggle with bespoke, poorly integrated password managers makes me cringe and is one of the big reasons I enjoy the seamless experience of the built-in Firefox password manager.

View on HN

Does it require a Firefox account? Does it only store them locally if you haven't signed in to Firefox? This is the sort of failure I've seen, where people think their passwords are synced but because they didn't sign in years ago it's actually not backed up at all. At least on Chrome you get reminded of that all the time on YouTube/Google search, etc.

I know for Safari all the sync is via iCloud meaning if you're not signed in it's locally stored and vulnerable in that way. Especially as many people can't/don't sign in to their own iCloud on work computers, or don't have a Mac.

Firefox reminds you a bunch of times, too. Would be nice if you could just link a new device via QR code (creating an account for you in the background).

The original Firefox sync worked like this (with a unique code and pairing instead of an explicit account) (this is so on the nose I suspect you may know this).

This blog post goes over some of that history: https://blog.mozilla.org/services/2014/04/30/firefox-syncs-n...

Didn't expect to click on that link and end up on a blog post I wrote 10 years ago! The old Firefox Sync / PAKE stuff was fantastic for getting sync going between devices... but people wanted backup, not sync. I wonder if we'd do anything differently confronted with the same challenge today.

Hey I love the syncing

> Does it require a Firefox account? Does it only store them locally if you haven't signed in to Firefox?

The passwords are available offline, so they are stored locally.

it just works for websites. it does not "just work" for apps where as the platform ones do or have a chance to work with apps.

Kind of hope regulation will force apple/google/ms to allow iterations for 3rd parties to integrate with the os but on the other hand that will open a host of issues

It does on iOS, but I believe the onus is on the app developer to enable the autofill feature in the form, or at least make sure that the app hints to iOS that it can be filled with a password. I'm making that assumption because there are lots of apps which don't trigger the native Apple password manager either (which is a lousy user experience). However, if one works then both do. The UI offers a choice of password manager and Face ID works to unlock it.

I use both. Apple's manager supports OTP generation which is nice, but on desktop websites, Firefox is often more convenient.

I use the Strongbox app on iOS [0] and the KeepassXC app my Linux laptop. The passwords.kdbx file sits on my Onedrive, which the Strongbox app can access. On Linux I use a Onedrive client [0] that I use to sync several folders within my home folder. Strongbox supports both Keepass and pwSafe database formats. It also integrates well with iOS, with autofill supported (also supports Yubikey unlock and Apple Watch unlock).

[0] https://apps.apple.com/app/strongbox-password-manager/id8972...

[1] https://abraunegg.github.io/

This discussion is about an open source password manager. I wonder why you are recommending a closed source software? Are you aware that many people prefer open source for security software for a reason?

I think most Strongbox users did not notice it turned proprietary. It's not like Strongbox advertised the change :)

Context: https://github.com/strongbox-password-safe/Strongbox/issues/...

Correct. I did not realise this and am disappointed, having paid a pretty penny for the lifetime license. Reading the github thread, the surreptitious way they changed things is a bit of a dick move.

Yep, it's the same problem on Android. Some app developers go full asshole with the password text boxes. There was one electric utility here that I lambasted hard and they finally fixed their form which not only didn't trigger the password manager, it literally blocked all pasting.

iOS already has all of the API required to integrate a password manager with the OS. Third party password managers can already integrate with both browsers and apps to provide passwords and password generation

But does it work for non-website passwords like the PIN for the door at your workplace or the usernames and passwords for your computers?

Yes. You can add whatever passwords. It asks you for a URL but you can put anything in.

> It asks you for a URL but you can put anything in.

Well, that’s kind of the problem isn’t it?

Yes, you can put bogus URLs, but it’s far from a great user experience

door://businesstreet/23/A/front

Someone understands URLs! The URL will be 30 years old soon[0], and still many people don't know what it really is.

[0] https://datatracker.ietf.org/doc/html/rfc1738

No end user understands URLs this way. Unless Firefox teaches them this, then this is nonsense

Yes, It's a joke. Sorry

Is it? I thought you were being serious

Yes, it's a joke. Sorry.

Why, though? Isn't it actually a good suggestion?

Agree! And it's funny.

Where is the joke? I don't get it!

Why not both?

Not supported. It can't be anything.

Technically maybe someone could make you navigate to that url in the future, through mitm or some sort of DNS poisoning, and autofill a form with your password and then auto submit it.

Can Firefox password manager work in other apps on Android?

Looks like yes[1]

1. https://support.mozilla.org/en-US/kb/end-of-support-firefox-...

yes and it's perfect. firefox (with ublock) are really the best experience on android.

that's not my experience, I've lost bookmarks due to firefox sync multiple times.

Does it have the ability to unlock with faceID on ios?

Yes it does.

That is such a laughable statement. 1Password has incredible UI/UX. Even has e-mail masking with Fastmail. And auto-enters TOTPs, for the less-important one’s you feel comfortable saving in your password manager.

Firefox sync made the criminal sin of implementing end-to-end encryption, enabling it by default, and being insufficiently clear to people that their passwords are lost forever when they forget the master password.

This provides a really terrible UX to "normal" users. I woulnd't recommend that option to anybody who doesn't already know what E2E is and what tradeoffs it has.

Google's implementation is a lot better in that regard, at least they offer plenty of avenues for account recovery.

Presumably the passwords themselves have recovery/reset procedures? I can't think of a good reason to add another risk surface to a password manager given that

Can you identify the password managers that do not implement end-to-end encryption so I can avoid them forever?

Reply on news.ycombinator.com