I was looking at these 2 tutorials on how to set up a sync service for Firefox:



And noticed how both didn't go into details about putting it behind SSL. Is SSL maybe not neccessary in this scenario because the data (bookmarks, passwords, etc.) is encrypted anyways? Or will this still expoxe the communication that takes place prior to the data-exchange, that is, my sync-server credentials?

(Sidenote, this is just for personal use, so no need to worry about handling a large load, etc.)

  • posted in wrong location, should be in superuser site... – Cold T Feb 20 '12 at 15:03

All data stored by Mozilla Sync is encrypted client-side, to guard against compromised servers and similar issues.

In older versions, Sync would prompt you for the encryption key (passphrase); nowadays a random key is generated when linking the first device, and can be retrieved via Sync → Manage Account → My Recovery Key.

When linking devices using the "Pair Device" functionality (by entering the three codes), the new device obtains the key directly from the old one using J-PAKE (see KeyExchange for details).

However, the credentials are transferred in plain text – Mozilla Sync appears to use HTTP Basic authentication, according to my tests.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.