Is it safe to sync using the Firefox built-in password manager and sync functionality? Where do they save my passwords and how do they save? What will be the risk?
Should I use LastPass instead?
Add a comment
|
3 Answers
Sync is more reliable in terms you don't have to worry about LastPass going out of business. Also my experience with the LastPass software is not so good - I like the Firefox sync more.
The passwords are encrypted in browser before sending them to the sync server. Should you lose the encryption key ( nowadays 26 digits ) it is not possible to get the passwords.
Your concern should go to whether Lastpass is in business in 10 years, if you get malicious software on your computer reading keyboard or harddrive and whether you sync your passwords to unsecure computer on later time.
-
6This is a biased post. For one, LastPass also encrypts your password before sending it off. On top of that LastPass has an offline mode. LastPass, unlike Firefox, offers versions on all mobile platforms, along with several forms of two factor authentication, which Firefox does not have.– surfasbAug 16, 2011 at 5:49
-
Yes. of course both encrypt the passwords before sending them. And they might be readable from Lastpass webpage in the future. the big difference between the two is that Sync uses firefox password options while Lastpass brings its own software. This own software hasn't been as good in finding the password fields. Aug 18, 2011 at 10:18
Personally, I would use LastPass instead. They offer two factor authentication like smartcards, their grid system, mobile text or USBkey. They also offer one time use passwords (for public logins).
They also offer an offline mode. It's also far easier to use and supports even the funkiest login screens.
Another handy feature is sharing a login without sharing the password.
You are raising an important point. IMO, Mozilla's choice to base both the encryption key derivation and the login token on the user password used to register the Mozilla identity account weakens the whole scheme. Although it is probably cryptographically safe to generate those tokens from the same information, it depends on the assumptions that the original login password never leaves the users computer. However, being a web-based login, users will be unaware and might enter the password in phishing attacks or it might be exposed via man-in-the-middle or website script-injection attacks. Having the login password for an attacker means that they would have the possibility to both access and decrypt users passwords saved in the sync account. Therefore, WEB LOGIN PASSWORDS SHOULD NEVER BE USED FOR DATA ENCRYPTION.
The old Firefox sync encryption scheme had separate login and encryption keys, it is still available in some Firefox-based browsers, for instance, PaleMoon. It had a very robust encryption but Mozilla developers thought this was too complicated for users to handle and understand two password and changed to the current scheme.
The current scheme has the explained flaw but an advanced design which would in theory enable the developers to add an (optional) second token to derive an encryption key in Firefox which is not linked to the Mozilla login password. However, this has to be implemented.
