Hi Remo,

This is not a security issue per se, you just have some misunderstanding. The primary password protects your local data on your computer. The synced data is encrypted by your Firefox Accounts password (technically a key derived from your password) on Mozilla's servers. When you login to Sync on your phone, you give your Firefox Accounts password, which decrypts the synced data.

Regards, Balázs

Hi!

Is there some technical documentation that describes the sync process and it's encryption in more detail?

I still think it is quite the security issue, if you just need access to a open instance of firefox an a pc to get to all passwords currently stored in the current users account. It also didn't ask me for a password to my account.

Many Greetings! Remo

Hi

In both cases, your user data (as with any other data on those devices) is protected by the password and operating system encryption that it is recomended that you have in place.

Hi!

You didn't get the point. It didn't ask for my account password on Android. So how did it decrypt the data? Since the data should be stored encrypted on Firefox servers and the key should be my password.

Many Greetings! Remo

Hi!

I had a look at the QR-Code and it seems to include the id and key of the account in clear text. For example: https://accounts.firefox.com/pair#channel_id=xyz&channel_key=xyz

And just as an addendum: Simply relying on OS encryption is not secure enough for something as sensitive as a password store. Each access resulting in clear text display of a password must require a password entry.

Many Greetings! Remo

You user credentials are stored on your device, not on a server.

And how does Firefox sync across devices, when credentials are not stored on a server?

You can read how it works here: https://mozilla.github.io/ecosystem-platform/docs/features/firefox-accounts/pairing

Thanks for the link! This explains in sufficient detail how the process works. I need more time to look at the other topics but it seems like I need another more secure password manager. Firefox asks me for my main password as soon as I start the browser and never forgets it as long as it runs. And on mobile devices it purely relies on OS protection. For me that is not enough.

Hi,

The people who answer questions here, for the most part, are other users volunteering their time (like me), not Mozilla employees or Firefox developers. If you want to leave feedback for Firefox developers, you can go to the Firefox Help menu and select Submit Feedback... or use this link. Your feedback gets collected by a team of people who read it and gather data about the most common issues.

You can also file a bug report or feature request. See File a bug report or feature request for Mozilla products for details.