לאתר זה תהיה פונקציונליות מוגבלת בזמן שאנו מתחזקים אותו לשיפור החוויה שלך. אם מאמר מסויים לא פותר את הבעיה שלך וברצונך לשאול שאלה, קהילת התמיכה שלנו מחכה לעזור לך ב־Twitter תחת ‎@FirefoxSupport וב־Reddit תחת ‎/r/firefox.

Avatar for Username

חיפוש בתמיכה

יש להימנע מהונאות תמיכה. לעולם לא נבקש ממך להתקשר או לשלוח הודעת טקסט למספר טלפון או לשתף מידע אישי. נא לדווח על כל פעילות חשודה באמצעות באפשרות ״דיווח על שימוש לרעה״.

מידע נוסף

אשכול זה הועבר לארכיון. נא לשאול שאלה חדשה אם יש לך צורך בעזרה.

Role of Master Password vs Sync account password

  • 3 תגובות
  • 3 have this problem
  • 7 views
  • תגובה אחרונה מאת John99

raghu.sodha
raghu.sodha
more options

I went through documentation on GitHub for Sync Protocol as well as other similar questions. I got basic understanding of how Sync security works. But still I would like experts to confirm this.

1. Master password is only used to encrypt data on local computer. 2. Sync account password is used for encrypting data before sending it to Mozilla servers. 3. Data on Mozilla servers is meaning less unless you know the Sync account password. 4. Mozilla does not store Sync account password anywhere. But instead they use hash/digest comparison method(or a similar method) to make sure that entered password is correct.

Could anyone please confirm above points?

One additional related question I have is, 1. Even if I do not set master password, I see that data is logins.json is encrypted. How this encryption is achieved?

I went through documentation on GitHub for Sync Protocol as well as other similar questions. I got basic understanding of how Sync security works. But still I would like experts to confirm this. 1. Master password is only used to encrypt data on local computer. 2. Sync account password is used for encrypting data before sending it to Mozilla servers. 3. Data on Mozilla servers is meaning less unless you know the Sync account password. 4. Mozilla does not store Sync account password anywhere. But instead they use hash/digest comparison method(or a similar method) to make sure that entered password is correct. Could anyone please confirm above points? One additional related question I have is, 1. Even if I do not set master password, I see that data is logins.json is encrypted. How this encryption is achieved?

השתנתה ב־ על־ידי raghu.sodha

פתרון נבחר

Hi

Thank you for your questions. As far as I am aware, all of the statements you make are true. In respect of your additional question, I recommend you have a read of this article.

I hope this helps, but if not, please come back here and we can look into this further for you.

Read this answer in context 👍 2

כל התגובות (3)

Paul
Paul
  • Top 25 Contributor
  • Moderator
more options

פתרון נבחר

Hi

Thank you for your questions. As far as I am aware, all of the statements you make are true. In respect of your additional question, I recommend you have a read of this article.

I hope this helps, but if not, please come back here and we can look into this further for you.

raghu.sodha
raghu.sodha Question owner
more options

Thanks Seburo.

I went through article. It does not mention how logins.json data is encrypted when master password is not set. But anyway, it is appropriate/wise to assume that when master password is not set all your passwords are in plain text.

Thanks Seburo and Mozilla.

John99
John99
more options

The point is if a master password is not set anyone with access to your Firefox may obtain the logins as simply as you can. Plus anyone with access to the computer and Firefox profile also has all those logins available.

I suspect the encryption of the logins within Firefox even when a Master Password is in use not very secure but unfortunately I do not recall where I saw that mentioned. (Probably in relation to Sync & Master password bugs) If you wish to obtain further information try the Mozilla forums, and if you do post there maybe let us have the link so we may follow the post