fxa-auth-server

> The old one let you run your own server. This is still possible with the new system, although I'll admit the ease and usability of such a setup needs work (and IIRC there are some changes required before android devices can properly use a third-party server; it may take a few releases before this become as easy as it was with the old system). > As it is, it's possible the new sync has a backdoor, > even one many people at Mozilla don't know. Both the client and server are open-source, and you can verify that the client follows the protocol [1] and doesn't leak anything more than a PBKDF2-stretched password derivative to the server. It's about as backdoor-proof as any client/server system is likely to get. But yes, it is more dependent on the strength of your password than the previous sync system. [1] https://github.com/mozilla/fxa-aut

You can run your own Firefox sync server, but it's a pain to implement. http://docs.services.mozilla.com/howtos/run-sync.html Once it's up and running, though, it's seamless. Edit: Hmm. Looks like they're happy to break this: " Some unknown proportion of the user base uses their own Sync servers ... [Asa] I don't think we should worry too much about this group. If we can identify them and message them that'd be sufficient for my concerns." https://services.etherpad.mozilla.org/sync-migration Well, thanks. Here's a code-dump of the new Firefox Account server. Not sure yet if I can implement this: https://github.com/mozilla/fxa-auth-server

True, if you accidentally lost data, this suggests the documentation should be better. But this is not entirely changing: class-A: data assigned to this class can be recovered, even if the user forgets their password, by proving control over an email address and resetting the account. It can also be read by Mozilla (since it runs the keyserver and knows kA), or by the user's IdP (by resetting the account without the user's permission). class-B: data in this class cannot be recovered if the password is forgotten. It cannot be read by the IdP. Mozilla (via the keyserver) cannot read this data, but can attempt a brute-force dictionary attack against the password. - https://github.com/mozilla/fxa-auth-server/wiki/onepw-protoc... We do not yet know which data will be assigned to which category by default, but it is likely that saved-passwords

The Sync protocol document is (linked in the article) has a lot of interesting details about the new system: https://github.com/mozilla/fxa-auth-server/wiki/onepw-protoc...

I wouldn't mind the server side component to this. I'd like to run my own server so that my devices can use. You'd imagine it would be available with it being Mozilla, right? Edits: YES! https://github.com/mozilla/fxa-auth-server

I expect those of us that host their own Sync server will have to deploy this[0] one instead. This is the general idea I got reading [1]. [0]: https://github.com/mozilla/fxa-auth-server [1]: https://blog.mozilla.org/services/2014/02/07/a-better-firefo...

This isn't really accurate. The problem with Firefox's current/old sync model is recovery. I.e., users think they're getting their stuff (history, passwords, etc) backed up, but when they lose their device, their data is gone forever, because almost none of them will have bothered to write down the long random string that functioned as their sync key. Also, the pairing was relatively hard to use for "normal" users. In the newer Firefox Accounts model, yes, Mozilla will use a username/password model for users. However, the password is never sent to Mozilla in the clear, and data is still encrypted with a password-derived key before being sent to Mozilla. However, users can still recover their data because they know (something that can be used to generate) the key used to encrypt their data. See here for more details: https://github.com/moz