I installed it and will compare it to Lastpass (which is pretty good IMO). HOWEVER, it saddens me to read on the front page: "using 256-bit encryption". I'd really expect the competent people at Mozilla to know that this statement means next to nothing. At the very minimum I want to know:
1) HOW is the key derived (say, "derived used PBKDF2 on the Firefox username + password")
2) WHERE is it encrypted (I assume "encrypted on the device/end-to-end/zero-knowledge"). It needs to be clear what the attack vectors are.
3) HOW is the secret managed (say, "Secret is wiped on all application switches")
and probably more that I forgot.
Using the app, the first thing I noticed is that I have a LOT of duplicate entries but no obvious way to clean that up.
EDIT: I see most of these details are on https://blog.mozilla.org/services/2014/04/30/firefox-syncs-n... but it doesn't change my disappointment in the totally useless "256-bit encryption" statement. Just say "strong encryption practices" and provide a link to the details. 8,192 bit encryption doesn't help you if you don't manage the key well.
1) HOW is the key derived (say, "derived used PBKDF2 on the Firefox username + password")
2) WHERE is it encrypted (I assume "encrypted on the device/end-to-end/zero-knowledge"). It needs to be clear what the attack vectors are.
3) HOW is the secret managed (say, "Secret is wiped on all application switches")
and probably more that I forgot.
Using the app, the first thing I noticed is that I have a LOT of duplicate entries but no obvious way to clean that up.
EDIT: I see most of these details are on https://blog.mozilla.org/services/2014/04/30/firefox-syncs-n... but it doesn't change my disappointment in the totally useless "256-bit encryption" statement. Just say "strong encryption practices" and provide a link to the details. 8,192 bit encryption doesn't help you if you don't manage the key well.