Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

When using Firefox Sync, you need a password (to login to your account) and an encryption key. Mozilla claims that it does not know your encryption key and that all data is encrypted before being send to Mozilla's servers.

However, when adding a new device, all you have to do is provide a key of 12 characters generated by the new device and enter that into a device that is already set up:

enter image description here

Once that has been done, your account name, password and encryption key are magically copied to your new device. How does this work, if Mozilla is never allowed to know your encryption key?

share|improve this question
    
I would venture a guess that the letters correspond to parts of the decryption key for that device, but that assumes asymmetric crypto. –  Broam Sep 16 '11 at 13:49

1 Answer 1

up vote 3 down vote accepted

The complete process including what and when it is communicated can be found on the Services/KeyExchange in the Mozilla Wiki.

The 12 characters you have to enter are containing a random secret plus a channel identifier. by the channel identifier both browsers can meet in the middle and establish an insecure communication channel via a central server in the back-end.

In the further process this channel is used to establish a secure connection using a cryptographic protocol called J-PAKE.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.