fxa-auth-server

The new Firefox sync (v1.5) is surely great and has good usability, I preferred the old Firefox sync (v1.1), because it didn't require a Mozilla account (for password retrieval). The new service requires two servers for one's fully own setup (for managing accounts and a sync server), although it is possible to use Mozillas account server. Also, from the description of the protocol ( https://github.com/mozilla/fxa-auth-server/wiki/onepw-protoc... ) it was not clear to me, what exactly is encrypted? Only the passwords? I had the impression that the bookmarks were stored in a way readable by Mozilla. Update. It is not clear what kind of data is in "Class-A" as described here: https://wiki.mozilla.org/Identity/AttachedServices/Architect... ... It also says: > we can share e.g. bookmarks with a third party (by telling them the decryption key)

Yes, sort of (more about the process: https://github.com/mozilla/fxa-auth-server/wiki/onepw-protoc...). Key difference: you don't need to sync all the data up again, since there's a separate key for that, which doesn't change. That said, if you forget your password you do lose remote synced data. The hope is that you have at least one device connected that still has the data, which will upload it in that case. This doesn't work in all cases (there's a pretty common and unfortunate pattern where someone reinstalls their OS, doesn't remember their password, and loses data as a result) You can also generate and store a separate recovery key to help avoid data loss, https://support.mozilla.org/en-US/kb/reset-your-firefox-acco....

Your logins are encrypted end-to-end, with a key that Mozilla's server don't have. You can find more about how sign-in and key management works in https://github.com/mozilla/fxa-auth-server/wiki/onepw-protoc...

Yes, they are encrypted on the client. https://blog.mozilla.org/services/2014/04/30/firefox-syncs-n... https://github.com/mozilla/fxa-auth-server/wiki/onepw-protoc...