Firefox Accounts: Total FAIL

So I’m in the process of installing Xubuntu 14.04LTS on a box and get to the point where I’m ready to install various daemons and utilities, then tweak their settings, so it’s time to have the new Firefox inhale all my settings from the Firefox on my 13.10 desktop, which will let me find all my blog posts with that information. This used to be a simple matter of going into the new Firefox’s Preferences, getting a one-time pairing code, typing it into the other desktop, and away it went, synchronizing the two installations.

But, no.

While I wasn’t watching, Firefox crept up to Version 29 and, at some point, Mozilla introduced Firefox Accounts. Why would they do that? Here’s a hint:

Firefox Accounts is a consumer account system which provides access to services run by Mozilla, such as Firefox Marketplace and the next version of Firefox Sync.

Firefox Marketplace? Say no more: money changes everything!

Oh, and the “next version of Firefox Sync” is totally incompatible with the “old version” used by all existing Firefox installations.

But it gets worse (emphasis mine):

What if I don’t want to update to the new Sync?

  • While the old version of Sync will continue to work, the latest version of Firefox doesn’t support adding new devices to the old version of Sync. This means that you won’t be able to sync with a new device.
  • Mozilla will continue to host the old version of Sync for a limited time to allow for migration to Firefox Accounts.

In order to sync the 14.10 Firefox, I must upgrade the 13.10 Firefox, but after I do that, none of the other boxes will be able to sync with either of them. I haven’t checked whether Firefox Version 29 is offered for the 10.04LTS installation that’s running on the LinuxCNC boxes.

My 13.10 desktop has endured many, many, many automatic Firefox upgrades during their recent version incrementing mania and, for whatever reason, it doesn’t offer “New Sync” as an option, despite being at the same Version 29 as the 14.04 installation. This is likely a problem with some Firefox extension or another, but I disabled them to no avail.

When all else fails, you always create a new profile by starting the Firefox Profile Manager:

firefox -profilemanager

That works as expected; the new and completely bare profile let me create a new Firefox Account, which entails the usual to-ing and fro-ing with emailed one-time authorizations and suchlike. OK, now I can use the shiny new Firefox Marketplace, should I so desire. Be still, my heart!

So, we progress.

But my original intent was to get all the setup data into the 14.04 Firefox, so (on the 13.10 Firefox) I followed the directions about transferring the old settings into the new profile, which involves tediously hand-copying a bunch of files from one cryptic directory to another. This is a brutally user-hostile operation that only geeks should endure; there is absolutely no automation to be found.

Having a new profile, albeit without any of the old extensions, I attempt to sync my settings, only to discover that the new Firefox Sync will not synchronize my stored passwords, which was pretty much the whole point of this exercise.

Turns out that’s deliberate:

Firefox Sync will not synchronize your passwords if a master password is set. If you would like to continue synchronizing your passwords, try removing your master password before synchronizing.

Now, why would I have a master password? Because, long ago, the good folks at Mozilla highly recommended it (emphasis mine):

It takes only fifteen seconds for a prying user sitting at your computer to see the list of all the passwords you have told Firefox or Thunderbird to save. The list is shown plain as day. It can include webmail and forum passwords or email server passwords. Using a Master Password is highly recommended, to prevent such prying users from seeing the list. By setting a Master Password, anyone using your profile will be prompted to enter the master password when access to your stored passwords is needed.

So, the new Firefox Sync requires a Firefox Account that doesn’t do anything I need done and, in order to sync my 13.10 settings into the 14.04 box, I must have a new Firefox Account and make both Firefox installations less secure.

I think it’s possible to remove the master password, sync the stored passwords, then restore the master password. When you remove the password, you get a confirmation message:

You have deleted your Master Password. Your stored web and email passwords, form data, and private keys will not be protected.

Firefox allegedly uses the Gnome keyring to get a master password protecting the whole Firefox session, but displaying all the stored passwords is just a few clicks away after that; needless to say, Firefox on 13.10 doesn’t use the keyring. Given that Chromium on Xubuntu 13.10 does not use the Gnome keyring, it’s entirely unprotected. Maybe the 14.04 box will use the keyring for both browsers?

What the hell do those people smoke? I want some of that, right here, right now!

Verily, money changes everything…

4 thoughts on “Firefox Accounts: Total FAIL

  1. Might i suggest LastPass (lastpass.com) and XMarks (xmarks.com), now both owned by the same company. They support Windows, Linux, OSX, iOS, and Android. Cross browser, cross platform bookmark and password sync. IIRC you only need to pay if you want to sync to a smartphone or tablet (for like $20/year). I’ve been using both for years because I need to sync across Chrome and Firefox on desktop and mobile.

    1. Thanks for the reminder; I don’t do much bookmarking (history is my co-pilot), but the password situation is completely out of hand.

      I’ve been using KeyPassDroid on the Kindle Fire; perhaps there’s some way to get all those passwords into Lastpass without re-re-typing them.

  2. Sounds like you need to check out Pale Moon (palemoon dot org). Forked off Firefox, with the extraneous code removed. Faster and more stable–no automagic updating, either. There’s also a migration tool that takes care of your profile. The site says it’s available for Linux and Win*, but not on the Mac. (The migration tool is not open source, but the rest is. All freeware.)

    I’ve been using it since the Eich kerfuffle, and have been quite happy about it. Somebody asked, and DRM will not be supported in Pale Moon, according to the maintainers.

    1. Looks good and works with the original Firefox profile, which has my original Master Password. Pale Moon seems to offer the “new” Firefox Accounts sync, so I must tinker with all the sync options to see what works.

      Thanks for the recommendation!

Comments are closed.