Hacker News new | past | comments | ask | show | jobs | submit login

A lot of people don't realise but the weakest point in their setup (from a security POV) is things like the password used on their browser sync account. There is a huge amount of responsibility on the sync service providers. Firefox literally knows everything about me and my accounts. Hell it knows passwords for accounts I don't even remember opening.

Self hosting the sync server makes a lot of sense. I think I will spend some time doing this over the Christmas holiday.




Personally I never let my browser remember my passwords, synchronized or not, precisely because it's a huge point of failure. I still think it's valuable for my history to be securely synchronized, but my Firefox Sync account does not have my passwords. Even though I do trust Firefox Sync and I have a very secure password, so this has nothing to do with that. But imagine that you leave your laptop open, then somebody passing by can get any password just by going to any website in your browser. And of course, with an open laptop, you can argue that you can be compromised regardless, as that passerby could install a keylogger. But security is all about raising costs for potential attackers.

Lately I've been a 1Password user, so that has made things easier. But even before that I've had a system of generating unique passwords and I could tolerate the pain of a fresh browser instance, because "remember me" works just fine. The only account you should not lose access to is your email account, because that email account can be used to recover the passwords for every other account. It's also the one account for which you need a really strong password and preferably 2-factor authentication.


Personally, I find it more convenient (and possibly safer) to use blueproximity to auto-lock my laptop if I forget to manually do so.


In the post they state that Mozilla never sees your password and that content is encrypted locally, so Mozilla doesn't actually appear to know very much about you at all. See the link in the post: https://blog.mozilla.org/services/2014/05/08/firefox-account...


I meant in the context that if somebody gets your sync password they get everything.


Well to be honest, if somebody gets the password to your email service, they get everything as well.


That's exactly the issue multi-factor authentication was invented for.


Yes. Which is something Firefox doesn't offer.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: