3

When using Firefox Sync, you need a password (to login to your account) and an encryption key. Mozilla claims that it does not know your encryption key and that all data is encrypted before being send to Mozilla's servers.

However, when adding a new device, all you have to do is provide a key of 12 characters generated by the new device and enter that into a device that is already set up:

enter image description here

Once that has been done, your account name, password and encryption key are magically copied to your new device. How does this work, if Mozilla is never allowed to know your encryption key?

Improve this question
1
  • I would venture a guess that the letters correspond to parts of the decryption key for that device, but that assumes asymmetric crypto.
    – Broam
    Sep 16, 2011 at 13:49

1 Answer 1

Reset to default
3

The complete process including what and when it is communicated can be found on the Services/KeyExchange in the Mozilla Wiki.

The 12 characters you have to enter are containing a random secret plus a channel identifier. by the channel identifier both browsers can meet in the middle and establish an insecure communication channel via a central server in the back-end.

In the further process this channel is used to establish a secure connection using a cryptographic protocol called J-PAKE.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .