https://www.olafkock.de/ok/2011/09/11/tno_trust_no_one.html First of all:This is not a security analysis, and no statement about the actual security of firefox sync. It's merely an analysis of the description given in the FAQ and my conclusion from that. And a brief one as well. I do not want to downplay the ... de Olaf Kock Fri, 23 Sep 2011 08:31:26 GMT Olaf Kock 2011-09-23T08:31:26Z de Olaf Kock https://www.olafkock.de/ok/ https://www.olafkock.de/ok/2011/09/11/tno_trust_no_one.html#comment1316948042532 @Richard. Thanks for the clarification. As I've been travelling I've been slow with answering - will do so in the FAQ as well. After all, with this information sync not only seems like a nice feature, but also as secure as I'd like features like this to be. Sun, 25 Sep 2011 10:54:02 GMT tag:www.olafkock.de,2011-09-11:default/c/1315768463934/1316948042532 2011-09-25T10:54:02Z https://www.olafkock.de/ok/2011/09/11/tno_trust_no_one.html#comment1316948020170 @Anonymous: I hope to have stated clearly that I didn't want to rant about the software that I didn't test. I merely wanted to react to the documentation that IMHO clearly prohibits to even try the software for the reasons given. Sun, 25 Sep 2011 10:53:40 GMT tag:www.olafkock.de,2011-09-11:default/c/1315768463934/1316948020170 2011-09-25T10:53:40Z https://www.olafkock.de/ok/2011/09/11/tno_trust_no_one.html#comment1316766686530 "We" in this case refers to Firefox. The FAQ is written for non-technical users; some degree of imprecision is sometimes necessary for readability. The sync key is generated on the client, and is never made available to Mozilla. (It can -- in encrypted form -- momentarily transit our servers during a J-PAKE exchange, but Mozilla is unable to obtain the cleartext.) Fri, 23 Sep 2011 08:31:26 GMT tag:www.olafkock.de,2011-09-11:default/c/1315768463934/1316766686530 2011-09-23T08:31:26Z