When using Firefox Sync, you need a password (to login to your account) and an encryption key. Mozilla claims that it does not know your encryption key and that all data is encrypted before being send to Mozilla's servers.

However, when adding a new device, all you have to do is provide a key of 12 characters generated by the new device and enter that into a device that is already set up:

enter image description here

Once that has been done, your account name, password and encryption key are magically copied to your new device. How does this work, if Mozilla is never allowed to know your encryption key?

  • I would venture a guess that the letters correspond to parts of the decryption key for that device, but that assumes asymmetric crypto. – Broam Sep 16 '11 at 13:49

The complete process including what and when it is communicated can be found on the Services/KeyExchange in the Mozilla Wiki.

The 12 characters you have to enter are containing a random secret plus a channel identifier. by the channel identifier both browsers can meet in the middle and establish an insecure communication channel via a central server in the back-end.

In the further process this channel is used to establish a secure connection using a cryptographic protocol called J-PAKE.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.