News for hackers. Stuff that matters.

A comment on Master password in Firefox or Thunderbird? Do not bother. Parent comment

Re:Master password in Firefox or Thunderbird? Do not bother by omnifischer on Sunday March 11, 2018 @06:04AM (#16562405)
'This means that any government Mozilla must obey can do the same thing.'

Please do not spread FUD. This is hn. Mozilla cannot see your passwords.

See the latest security audit: https://blog.mozilla.org/security/2017/07/18/web-service-aud...

https://medium.com/mozilla-tech/how-firefox-sync-keeps-your-...

[ Parent | on HN ]
Re:Master password in Firefox or Thunderbird? Do not bother by eadmund on Sunday March 11, 2018 @07:50PM (#16565365)
> Please do not spread FUD. This is hn. Mozilla cannot see your passwords.

They process your password with JavaScript they deliver to your browser; they can at any time choose to deliver different, malicious JavaScript which sends them the raw password instead.

It's not FUD; it's the honest truth. For details, see my note https://news.ycombinator.com/item?id=16565382

[ Parent | on HN ]