Mozilla Rolls Out Recovery Key Option For Firefox Accounts (zdnet.com)

Mozilla announced today a new recovery option for Firefox Accounts, the user system included inside the Firefox browser. ZDNet: Starting today, users can generate a one-time recover key that will be associated with their account, and which they can use to regain access to Firefox data if they ever forget their passwords. Firefox Accounts is included with all recent versions of the Firefox browser.

Most users are familiar with it because of Firefox Sync, the system that synchronizes Firefox data such as passwords, browsing history, open tabs, bookmarks, installed add-ons, and general browser options between multiple Firefox instances. But while Sync does the actual synchronization, Firefox Accounts is at the core of Sync and is the system that manages the identities of Firefox users. Sync works by taking a user's Firefox account password and encrypting the user's browser data on the local computer.

Comments

what year is this?

[Tsolias]

they had this option 10 years ago where you got a hash that you used to verify that it's you.... along with your username+password.
The only option they don't give you is to pull your data out of their system.
They have introduced so many changes to that goddamn sync system that it is incompatible with every ff derivative.

Re:what year is this?

[Anonymous Coward]

It's a fucking dumb idea anyway. All it does is provide another method of attack to hackers. If a user somehow forgets their password, then too fucking bad. Maybe next time they'll pay attention to the shit that they claim is important to them.

Re: what year is this?

[Anonymous Coward]

No shit, I have finally deleted my Firefox profile and sync account, just LAST WEEK, along with my recovery guid. I am done with Firefox permanently.

The site is still shit but another kind of shit

[Anonymous Coward]

Whatever became of CmdrDildo?

Re:The site is still shit but another kind of shit

[Anonymous Coward]

After he sold out to LNUX their stock price tanked before his lock expired. By the time he could sell his shares were effectively worthless. On the realization that he had sold his web site for $0.01 - the cost of the PT Cruiser he gave away, he fell into depression, deleted his Linux boot partition, and his wife left him.

Last I heard he was living with Vladinator rent free in return for doing admin work on Vlad's hosting farm that runs Windows NT.

Do people use Firefox Sync?

[Anonymous Coward]

Do you use Firefox Sync? Just curious how popular it is. I don't (nor do I ever "log into" Chrome) but maybe that's just 'cuz I'm old.

Re:Do people use Firefox Sync?

[CaptainDork]

Because you're too goddam lazy to click next door.

Browser Market Share Worldwide - August 2018
Chrome 59.67%
Safari 14.51%
UC Browser 6.28%
Firefox 4.93%
Opera 3.5%
IE 3.03%

Re:Do people use Firefox Sync?

[gman003]

I use it pretty heavily. I have a lot of computers - home desktop, work desktop, laptop, tablet, phone, that one with all the MIDI stuff. Sync lets me move between them fairly seamlessly.

Sync lets me see what tabs I have open on each machine. I saw this comment this morning on my tablet, didn't feel like finding my keyboard cover to type out a reply, so I left the tab open. I grabbed that tab from my work desktop, which is where I'm typing this now.

I can even send a tab to another computer. I use that a lot on my phone - "Oh, this looks interesting, let me send it to a bigger screen so I can actually read it". Or to send it closer to where I would use it - I can push an article on music theory over to my DAW computer, or a review for a game I might want to buy to my gaming machine, or a programming rant to my work computer.

It also just keeps my browser setup mostly the same between computers. My bookmarks bar has the exact same things on every computer, with no effort needed on my part. All my addons automatically install on new computers when I sign in.

There's a few defects. History syncs incompletely - redirect pages only sync the final destination, so if an RSS feed points to a redirect, only the original computer remembers that I've been there. Something goes wonky with the order of bookmarks sometimes. Settings for addons don't sync, so my custom Adblock list needs manual copying. But it's overall quite a useful feature.

Synch?

[Zorro]

Why would I DO that?

Every device has a different identity.

Diffrent emails and different accounts for every resource.

That way one confiscated or stolen device can only compromise those accounts.

Then I can brick it remotely.

Re:Synch?

[ls671]

Indeed, indeed, I don't use sync.

Basically screw the cloud for my sensitive data!

More details:
I don't even use the save password feature and I read my emails in pine. So, I will never ever need a recovery key for firefox. I have a proper backup strategy for everything including firefox configs and bookmarks. Backups are made on an encrypted partition on a remote data center on a server which I control fully and which nobody else can access since I wiped the disks and installed my own OS and I check for reboots and physical tampering with the intrusion sensor which tells you in the case is ever opened.

Also the remote backup server logs to a computer in my house in real time through a vpn to make sure I have a log copy what ever happens
example from syslog.conf:
authpriv.* -/var/log/secure
authpriv.* @10.256.222.53 // this is my home server

So the remote backup server logs locally on its disk and to my home server in real time.

sensors output example, see "intrusion" on last line

2,17,32,47 /usr/bin/sensors | /usr/bin/logger
Adapter: ISA adapter
Core 0: 48.0C (high = 82.0C, crit = 100.0C)
Core 1: 50.0C (high = 82.0C, crit = 100.0C)
Core 2: 48.0C (high = 82.0C, crit = 100.0C)
Core 3: 47.0C (high = 82.0C, crit = 100.0C)

w83627dhg-isa-0290
Adapter: ISA adapter
Vcore: 1.29 V (min = 0.92 V, max = 1.48 V)
in1: 0.76 V (min = 0.67 V, max = 0.83 V)
AVCC: 3.23V (min = 2.96 V, max = 3.63 V)
+3.3V: 3.23V (min = 3.46 V, max = 0.91 V)
in4: 1.84V (min = 1.36 V, max = 2.04 V)
in5: 1.26V (min = 1.13 V, max = 1.38 V)
in6: 1.45V (min = 1.42 V, max = 1.52 V)
3VSB: 3.23V (min = 2.96 V, max = 3.63 V)
Vbat: 3.23V (min = 2.96 V, max = 3.63 V)
fan1: 2909RPM (min = 712 RPM, div = 8)
fan2: 3375RPM (min = 712 RPM, div = 8)
fan3: 0RPM (min = 753 RPM, div = 128)
fan4: 0RPM (min = 753 RPM, div = 128)
fan5: 0RPM (min = 753 RPM, div = 128)
temp1: 50.0C (high = 75.0C, hyst = 70.0C) sensor = thermistor
temp2: 54.0C (high = 87.0C, hyst = 82.0C) sensor = CPU diode
temp3: 54.0C (high = 87.0C, hyst = 82.0C) sensor = CPU diode
intrusion0: OK

Re:Synch?

[viperidaenz]

I control fully and which nobody else can access since I wiped the disks and installed my own OS, but left the Management Engine firmware intact and always running, with full access to system RAM and accessible via the network connection before it hits the system firewall.

physical tampering with the intrusion sensor which tells you if the case switch is opened

ftfy.

What, with a 1.3Vcore it's probably an Intel Core2 Quad or something of that era?

Re:Synch?

[ls671]

Yeah! Good point!

You seem to know much more than I do so I have questions for you:

1) What is the layer of this management protocol? I mean IP or ether? What if you have a fiber adapter?

2) I assumed it wasn't IP but some lower level protocol and that it couldn't be possibly reached in any case through the Internet. Am I right?

3) If I ever was right in question 2; how close do you need to be from the server to attack it? For example, I understand that anything using a hub wouldn't be an obstacle but would a switch properly configured prevent reaching the server?

4) My home and other servers have non-Intel adapter for that very reason but the data center server uses an Intel adapter. Am I correct to assume that I am not vulnerable if I don't use an Intel adapter?

Example:
Realtek Semiconductor Co., Ltd. RTL8111/8168/8411 PCI Express Gigabit Ethernet Controller (rev 02)
Broadcom Corporation NetLink BCM57780 Gigabit Ethernet PCIe (rev 01)
Realtek Semiconductor Co., Ltd. RTL8169 PCI Gigabit Ethernet Controller (rev 10)

If it helps, the server adapter is:
Intel Corporation 82566DM-2 Gigabit Network Connection (rev 02)

P.S. I have downloaded stuff from Intel before to test this but I am afraid to fall even deeper in the pit since it looks like you have to install a module! Not that I am afraid to build a kernel module or even flash firmware but trust in Intel at this point is as low as expected especially if you take into account the various problems that surfaced in handling the situation after this was made public.

How could I possibly really test this on the data center server without Intel tools? Renting a throw away machine on the same rack just for the purpose of the test? :)

Thanks in advance!

Re:Synch?

[ls671]

Sorry, I forgot to mention that when I wrote the following:

You seem to know much more than I do so I have questions for you:

it was linked to you writing:

What, with a 1.3Vcore it's probably an Intel Core2 Quad or something of that era?

I really enjoyed reading your sentence!

Cheers!

Re:Synch?

[viperidaenz]

You shouldn't take advice from random people on slashdot.
You're bound to get trolled.

Re:Synch?

[ls671]

Who says I do?

Re:Synch?

[_merlin]

You really shouldn't be using pine if you care about security. It's notorious for being coded in an insecure way, and it's going to be trivial to find exploits with basic data fuzzing. You're better off with mutt or something - pine is one of the packages you blacklist in environments where security matters.

Re:Synch?

[Waccoon]

I use different web browsers to access my different online accounts. Sometimes I use a different computer.

Monocultures are stupid.

Re:Synch?

[ls671]

Hey man, my questions were serious. Do you have time to review them for myself and the community? I don't mean for you to do any research, just answer them to the best of your knowledge if you can.

I enjoy taking advice from many sources but in the end, I should have replied "I do, but who says I necessarily apply that advice".

Thanks in advance!

Re:Synch?

[ls671]

Thanks for your advice!

Re:Synch?

[viperidaenz]

Non-Intel network adapters should be fine, but I'm not a security researcher so don't take my advice.
A hub or switch don't stop it, as it's TCP/IP. You could configure your router to block it, but that won't stop anything on the same subnet.

Apparently it can even cause problems by intercepting legitimate packets if your OS chooses one of the AMT ports as the source port. It's not in the ephemeral port range though, so it shouldn't conflict.

Re:Synch?

[ls671]

Thanks!

How about let us recover our old extentions?

[Anonymous Coward]

XUL master race.

Re:GOP RAPE PARTY NEEDS PRISON

[Anonymous Coward]

I was at a college party when I was younger and I was raped by Anonymous Coward. Jail him now!!!! No due process!!! Hang the bastard!!!!

GOP - THE PARTY OF RAPE @ PARTIES

[Anonymous Coward]

No no, don't investigate, give me a LIFETIME SUPREME RAPIST appointment! All the women in the world are liars, there's no reason to spend more than a few hours delaying because I'm a FUCKING RAPIST REPUBLICAN.

This is THE PARTY OF RAPE now.

Re:GOP - THE PARTY OF RAPE @ PARTIES

[Anonymous Coward]

Did they steal the title from the Democunts when they remained silent as Billy boy abused his position for sex from an intern? That's rape too, ya know.

Fuckers don't whisper a word about what you claim to be against until it suits your political goals. That's what makes you shitballs. Fuck both your fucking parties. Lying cunts the whole way around.

Re:GOP - THE PARTY OF RAPE @ PARTIES

[Anonymous Coward]

No no, don't investigate, give me a LIFETIME SUPREME RAPIST appointment! All the women in the world are liars, there's no reason to spend more than a few hours delaying because I'm a FUCKING RAPIST REPUBLICAN.

This is THE PARTY OF RAPE now.

Huh?

[Anonymous Coward]

I don't understand. What do browser share figures have to do with what features the users of each browser use? Are you saying that you choose your browser by sorting the list and taking the top one? If so, maybe I should ask: do you log into Chrome? My understanding is that that is a similar feature to Sync.

Perhaps you think I was asking if Firefox is popular. I was actually asking about Firefox Sync feature that's part of Firefox. I don't use it and I'm wondering if other people do, and if so, what they think of it.

Yes, I'm lazy, but I actually did download and install Chromium (and Chrome at work). On desktop, it's an ok browser, but not quite as good as Firefox so I currently use Firefox. (On Android, though, Chrome totally sucks and Firefox is the only browser I've found that's even usable. Chrome for Android makes me wonder if other users like seeing ads all over everything.)

Re:Huh?

[LoneBoco]

I use it. I have it sync bookmarks, history, open tabs, and addons between my desktop, laptop, and phone. By using sync, I can use the "Send to Device" feature to push URLs directly to my phone. And send them from my phone to my PC. I can also look at what tabs I have opened on my desktop from my phone browser in case I want to continue something on my phone.

Re:Huh?

[CaptainDork]

And BONUS!

Your embarrassing and potentially job-losing shit shows up on your BYOD or work desktop and on the firewall logs.

Management sent some people home for just that reason.

Re:Huh?

[LoneBoco]

Haha, yeah, don't use Firefox or Chrome sync on work devices. I use an entirely separate laptop and phone for work and don't link up any personal accounts to them.

Re: Huh?

[Anonymous Coward]

I log in for my personal account because I like to have my passwords and history on any computer I pick up around the house.
For work, I have only one browser and do not log in.

Re:Huh?

[CaptainDork]

I'm with ya.

Back when I was young and foolish, I used Chrome.

I logged in to Gmail at work to get an attachment I had sent myself.

Of course, I logged in to YouTube, Google+, and every other goddam property Google owns and my desktop Chrome synced up bookmarks and shit.

What a mess. I used a tree branch tied to a horse to cover my tracks and I got strange looks that morning.

Why is this needed?

[LoneBoco]

Firefox Sync's master key has been protected by SHA1 with 1 iteration for almost 10 years now. If you lose your password, you can probably just brute force it in only a couple minutes.

duh

[Anonymous Coward]

You get a password to give if you ever forget your password.

Ugh

[Anonymous Coward]

FF after every upgrade: "Sign in to your account! If you don't have one, sign up today!"

Me: "Fuck off." *clicks close