1431634 - Add option to remotely clear all browser data(on disconnecting device)when disconnecting a divice(other than current) using firefoxsync(accounts.firefox.com/settings)

Status: RESOLVED WONTFIX

(Cloud Services :: Server: Firefox Accounts, enhancement)

Description

[In]

If one's device is stolen or password is leaked
It is hard and time consuming to change password for all sites
If the victim is late they can be damaged

Comment 1

[:Gijs (he/him)]

This bug report doesn't need to be kept hidden.

Comment 3

[In]

(In reply to :Gijs from comment #1)
> This bug report doesn't need to be kept hidden.

I meant to add option remotely clear browser data of connected devices to prevent privacy issues.

Comment 4

[Lina Butler (ex-Mozilla)]

Thanks! We're working on a plan for this in bug 1409208, and you can also follow the meta bug 1325271.

Comment 5

[Lina Butler (ex-Mozilla)]

Actually, I'm sorry; this is different: you're asking for a "remote wipe" option in the device manager. Alex, CCing you because I know you've been thinking about this.

Comment 6

[Alex Davis [:adavis]]

We are investigating the engineering work required for this but please note that:

- For lost or stolen devices, we recommend to use the remote wiping of your OS provider after disconnecting a remote device from your account settings. This is much more important because you will likely have more than just Firefox at risk on you lost or stolen device. For Firefox to remote wipe the browser data, the malicious user will need to login to the device OS and open Firefox whereas you can prevent them from getting this far at an OS level.
- Remote wiping via Firefox is a very limited solution if you LEAKED your master password. You should consider that all your passwords are compromised and are now backed up by the malicious user outside of Firefox. We recommend that you
 1) Change your Firefox Account password 
 2) Disconnect lost or suspicious devices
 3) Change your email password
 4) Then change all of your other passwords that were saved in Firefox
This will prevent your password changes from propagating to any compromised devices.

Comment 7

[In]

When disconnecting from sync "password should be asked to keep data on disconnecting device" to this feature to work completely.

Comment 8

[In]

To prevent this feature being used against victim there has be SMS verification.

Comment 9

[Lina Butler (ex-Mozilla)]

(In reply to In from comment #7)
> When disconnecting from sync "password should be asked to keep data on
> disconnecting device" to this feature to work completely.

This won't help much, sadly, for the reason that we don't currently use your FxA password to encrypt anything in the profile directory. If your device is lost or stolen, an attacker could disconnect from the network, open your profile directory, and copy your passwords and autofill data out before Sync runs. It's easy to circumvent...and, unfortunately, gives the wrong the impression that "I disconnected and cleared everything, so I should be fine," when you're as much at risk. :-(

That's why building this in is more of a convenience than a security measure. Unless you're using OS-level encryption, you'll have to assume that *all* your passwords (and, as Alex says, everything else on that computer) are compromised.

Comment 10

[In]

(In reply to Kit Cambridge (they/them) [:kitcambridge] from comment #9)
> (In reply to In from comment #7)
> > When disconnecting from sync "password should be asked to keep data on
> > disconnecting device" to this feature to work completely.
> 
> This won't help much, sadly, for the reason that we don't currently use your
> FxA password to encrypt anything in the profile directory. If your device is
> lost or stolen, an attacker could disconnect from the network, open your
> profile directory, and copy your passwords and autofill data out before Sync
> runs. It's easy to circumvent...and, unfortunately, gives the wrong the
> impression that "I disconnected and cleared everything, so I should be
> fine," when you're as much at risk. :-(
> 
> That's why building this in is more of a convenience than a security
> measure. Unless you're using OS-level encryption, you'll have to assume that
> *all* your passwords (and, as Alex says, everything else on that computer)
> are compromised.

Why assume the bad is clever?

Comment 11

[Wil Clouser [:clouserw]]

Thank you for filing this issue. This is not currently on our roadmap, and in an effort to focus our work, we are closing old issues that we are unlikely to be closed in the future. Thanks again.