On 20/08/2015 04:01, Nicholas Alexander wrote: > Hi folks, > > I wanted to let people know of some significant changes coming to the > Firefox Accounts implementation in Fennec. The native accounts > implementation is being replaced with a hybrid native-and-on-the-web > implementation.
Thanks for the thorough overview Nick, I'm excited to see this work moving forward. > The motivation is to get the Fennec team out of the Accounts team's > path. The Desktop product has shown that hosting Firefox Account > interface on the web is a viable, iterable solution that lets us provide > a great user experience across our products. By unifying our technical > approach across our products [2] we unlock the Accounts team to move > faster on features that would otherwise require Fennec team support: for > example, adding robust 2-factor authorization, or optimizing our sign up > experience. And likewise, we unlock the Fennec team to continue shipping an awesome mobile experience with one less chunk of functionality to maintain :-) > Second, this changes the Firefox Accounts security story in Fennec. > Currently, your Firefox Account password never leaves your device: your > password is never stored (although a derivative is stored for a short > time) and is never exposed to web content. This will change: > accounts.firefox.com <http://accounts.firefox.com> will have access to > your password. An attacker who > compromises (or compels) Mozilla has an attack that they did not have > previously. The Accounts team has considered this attack and takes > mitigating steps, but I can't find a good reference right now [4]! One concrete step we take in desktop is to do SSL certificate pinning for accounts.firefox.com and (maybe?) its subdomains. There are likely more that I don't have the details of at hand. Cheers, Ryan _______________________________________________ mobile-firefox-dev mailing list [email protected] https://mail.mozilla.org/listinfo/mobile-firefox-dev
