Lockwise Breach Notification Policy-based disabling
Categories
(Toolkit :: Password Manager, enhancement)
Tracking
()
People
(Reporter: wpgraphix, Unassigned)
Details
User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:75.0) Gecko/20100101 Firefox/75.0
Expected results:
Please provide an ability to disable Lockwise Breach notification for orgs using Policy key:values.
$ORG requires that all data of this type is not sent out (url's, data, etc).
This can be disregarded. We disable Firefox sync which turns off Lockwise entirely anyway.
|
||
Comment 2•6 years ago
|
||
From my limited knowledge related to breach notifications, I can see how something like disabling it via policy might be something useful without actually disabling sync. (AIUI it was possible at some point to set custom local sync servers).
Matt, is this something it would worth consider?
It requires Sync to even use LockWise. If LockWise was available without sync integration and existed locally, that would be awesome.
If Sync could be setup for custom servers, that would be a HUGE use case here.
|
||
Comment 4•6 years ago
|
||
(In reply to wpgraphix from comment #0)
Please provide an ability to disable Lockwise Breach notification for orgs using Policy key:values.
$ORG requires that all data of this type is not sent out (url's, data, etc).
The Lockwise breach/vulnerable notifications do not send any user data to Mozilla. The browser downloads the breached domains and it looks only at domain + date to determine if a warning should be shown. It doesn't even look at the username or password values. This is different than the Monitor website.
(In reply to wpgraphix from comment #1)
This can be disregarded. We disable Firefox sync which turns off Lockwise entirely anyway.
There is a separate policy for disabling the password manager but the Sync one shouldn't do this.
(In reply to Adrian Florinescu [:aflorinescu] from comment #2)
From my limited knowledge related to breach notifications, I can see how something like disabling it via policy might be something useful without actually disabling sync. (AIUI it was possible at some point to set custom local sync servers).
I don't see why a user would be allowed to save passwords but wouldn't be allowed to know if the password was breached or vulnerable.
|
|
||
Comment 5•6 years ago
|
||
(In reply to wpgraphix from comment #3)
It requires Sync to even use LockWise. If LockWise was available without sync integration and existed locally, that would be awesome.
Sorry, but you are incorrect and this is due to the misleading use of the Lockwise brand in about:logins. You can save passwords in Firefox desktop without Sync. The Lockwise mobile apps do require Sync. Firefox mobile do not either.
If Sync could be setup for custom servers, that would be a HUGE use case here.
It can be for a long long time. Not all apps (Lockwise mobile apps) support it.
There is a separate policy for disabling the password manager but the Sync one shouldn't do this.
DisableFirefoxAccounts is what we used to block everything related to sync. I missed the button to create a new login. I was just seeing the "Set up a Firefox Sync account" right in the middle that was stealing my attention.
The Lockwise breach/vulnerable notifications do not send any user data to Mozilla. The browser downloads the breached domains and it looks only at domain + date to determine if a warning should be shown. It doesn't even look at the username or password values. This is different than the Monitor website.
Awesome, this makes it safe in our Org.
From my limited knowledge related to breach notifications, I can see how something like disabling it via policy might be something useful without actually disabling sync. (AIUI it was possible at some point to set custom local sync servers).
I don't see why a user would be allowed to save passwords but wouldn't be allowed to know if the password was breached or vulnerable.
We prevent users from using third party cloud services for Passwords. InfoSec Policy for that. Local to computer password managers work fine. With how well LockWise is integrated, I was exploring this but a Security engineer wanted to make sure Firefox wasn't sending password/account data to a third party service. Second quote makes this possible :)
It can be for a long long time. Not all apps (Lockwise mobile apps) support it.
Do you happen to have a link to where this can be set (guessing it requires a custom build)? Looking at the policy templates, I see no way to enforce the sync service hosting via Policies.
Thanks for the info all, this issue can still remain resolved :)
Found this:
https://wiki.archlinux.org/index.php/Firefox_Sync_Server#Installation
The installation requires Python2. Py2 is EOL so we couldn't even use it if we wanted currently.
Note: Since version 1.5 of the protocol, a Firefox Account is required in order to use the synchronization service.
It also requires a Firefox Account to use, which seems to defeat the point of a custom sync service?
Either way, my questions/concerns/comments were all answered.
Thanks all
|
|
||
Comment 8•6 years ago
|
||
You can self-host the FxA piece too. I don't know about a policy for it but you just set a few prefs for it, no custom build needed.
Official sync self-hosting docs: https://mozilla-services.readthedocs.io/en/latest/howtos/run-sync-1.5.html (yes, still py2)
|
||
Comment 9•6 years ago
|
||
We have a policy for disabling user messaging if need be. It might be worth adding this to that list just in case.
Description
•