firefox-lockbox

This is great feedback. We are currently working on improvements on this specific finding. We'll continue to provide updates to make Firefox Lockbox a better experience. Thanks for trying and testing the app.

Your logins are encrypted end-to-end, with a key that Mozilla's server don't have.

You can find more about how sign-in and key management works in https://github.com/mozilla/fxa-auth-server/wiki/onepw-protoc...

Firefox on iOS provides an integrated experience for logins and filling those logins into browser forms automatically.

The team is currently working on autofill from Lockbox into other apps: https://github.com/mozilla-lockbox/lockbox-ios/issues/486. This will only be available in iOS12 when that ships.

Are there other kinds of integration you see as valuable?

Thanks for this, and wanting to know more! We're working on expanding our docs to add this.

Firefox Lockbox architect here. Thank you for the feedback. Your comment is fair; we can, and will, do better on the details. The language we have today is the balance marketing, security reviewers, and engineering could reach for the masses to feel informed without being overwhelmed and confused.

As you found, Firefox Accounts derives the encryption key from your username and password on the client-side; the server is never aware of your password. That encryption key protects your data on your device using AES-256-GCM, and is stored in its security enclave behind Touch ID or Face ID wherever possible.