Funkcionalnosć toś togo sedła se pśez wótwardowańske źěła wobgranicujo, kótarež maju wašo dožywjenje pólěpšyś. Jolic nastawk waš problem njerozwězujo a cośo pšašanje stajiś, wobrośćo se na našo zgromoźeństwo pomocy, kótarež na to caka, wam na @FirefoxSupport na Twitter a /r/firefox na Reddit pomagaś.

Avatar for Username

Pomoc pśepytaś

Glědajśo se wobšudy pomocy. Njenapominajomy was nigda, telefonowy numer zawołaś, SMS pósłaś abo wósobinske informacije pśeraźiś. Pšosym dajśo suspektnu aktiwitu z pomocu nastajenja „Znjewužywanje k wěsći daś“ k wěsći.

Dalšne informacije

Toś ta nitka jo se archiwěrowała. Pšosym stajśo nowe pšašanje, joli trjebaśo pomoc.

Why does Firefox Sync removes data when password was changed?

  • 3 wótegrona
  • 1 ma toś ten problem
  • 2 naglěda
  • Slědne wótegrono wót Jamie Kitson

firefox_user_1665322
firefox_user_1665322
more options

Hi,

First of all let me indicate that I appreciate the job you have been doing as Firefox support / development teams.

I've just learned that firefox sync removes the stored data when password was changed right after trying to get help for not-restored settings. I think it is quite common forgetting a password and recovering by mail - reset. I am just so curious about the reason why Firefox Sync removes all data when password was changed.

Hi, First of all let me indicate that I appreciate the job you have been doing as Firefox support / development teams. I've just learned that firefox sync removes the stored data when password was changed right after trying to get help for not-restored settings. I think it is quite common forgetting a password and recovering by mail - reset. I am just so curious about the reason why Firefox Sync removes all data when password was changed.

Wšykne wótegrona (3)

philipp
philipp
  • Moderator
more options

hi, this is due to the security-focused design of sync - before it leaves your device, all sync data gets encrypted with a key derived from your password & only this encrypted dump is stored on the sync servers. there is no other way to get to the encrypted data, than knowing your original password (not even for mozilla or other "interested parties"). there should also be a warning about all stored sync data being gone at the beginning of the password changing procedure in firefox accounts.

the very technical details of this process are described at https://github.com/mozilla/fxa-auth-server/wiki/onepw-protocol

firefox_user_1665322
firefox_user_1665322 Pšašaŕ
more options

So, in my humble opinion; just decrypt data when user resets his/her passwd and re-encrypt data with the new passwd. OK, I know you'll say it's not possible to decrypt data without the passwd that it was encrypted first but ... don't you think user is still authorized to view or restore them once he/she resets via e-mail? Putting a warning message is not enough. Any personal account is recoverable without data loss in today's world. Even still if it has to be used, then this very important information should be highlighted in bold red letters, warning icons, in a separate step of the wizard. I need to cover a lot of passwords. However I feel like I am speaking against the famous for privacy policy of the firefox that I've been using for a long time with love. Maybe you're right. Maybe browser is on top of other personal accounts like a main gate.

Anyways guys, make it better, ok? Good luck with that.

Jamie Kitson
Jamie Kitson
more options

firefox_user_1665322 said

don't you think user is still authorized to view or restore them once he/she resets via e-mail?

The whole point is that Mozilla can't access your information. Your login details and browsing history would be a goldmine for governments/hackers, this way Mozilla can tell governments where to go because they really can't access it, and likewise they can't access it if someone forgets their password. If you're not that bothered about security then just choose a really weak, easy to remember password.