Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I was looking at these 2 tutorials on how to set up a sync service for Firefox:

http://alien.slackbook.org/blog/setting-up-your-own-mozilla-sync-server/

https://wiki.archlinux.org/index.php/Mozilla_Sync_Server

And noticed how both didn't go into details about putting it behind SSL. Is SSL maybe not neccessary in this scenario because the data (bookmarks, passwords, etc.) is encrypted anyways? Or will this still expoxe the communication that takes place prior to the data-exchange, that is, my sync-server credentials?

(Sidenote, this is just for personal use, so no need to worry about handling a large load, etc.)

share|improve this question

migrated from serverfault.com Feb 20 '12 at 15:07

This question came from our site for professional system and network administrators.

    
posted in wrong location, should be in superuser site... –  Cold T Feb 20 '12 at 15:03

1 Answer 1

up vote 1 down vote accepted

All data stored by Mozilla Sync is encrypted client-side, to guard against compromised servers and similar issues.

In older versions, Sync would prompt you for the encryption key (passphrase); nowadays a random key is generated when linking the first device, and can be retrieved via Sync → Manage Account → My Recovery Key.

When linking devices using the "Pair Device" functionality (by entering the three codes), the new device obtains the key directly from the old one using J-PAKE (see KeyExchange for details).

However, the credentials are transferred in plain text – Mozilla Sync appears to use HTTP Basic authentication, according to my tests.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.