Sync passphrase does nothing?
-
leocg Moderator Volunteer last edited by
there was a change made to the setup, and they now say that they are encrypting everything, but they are not actually doing it.
As he FAQ says, data is not encrypted on the server, but only during the transfer between the computer and the server:
Everything is encrypted in transit between client and server. However, non-login data is not stored encrypted on the >servers. If we later decide to sync sensitive private data, such as passwords, we will encrypt that as well.
On opera://sync-internals/, if you go to the tab 'Sync node browser' you may see what is encrypted.
So, if they are not encrypting everything, then why did the update the wording within the sync UI to say that they are?
Maybe something inherited from Chromium? Maybe a fault in the UI like i said? Or maybe it's being encrypted but only during the transfer like the FAQ says?
-
mikecerm last edited by
As he FAQ says,
That 2-year-old FAQ is has nothing to say about the current state of sync.
You can't be serious if you think that it's okay that Opera is saying that data will be encrypted and then not doing it. You can't seriously think that it's okay that Opera copied the sync feature wholesale from Chromium, and removed all of the privacy and security, but left in place the the claims about privacy and security.
-
leocg Moderator Volunteer last edited by
That 2-year-old FAQ is has nothing to say about the current state of sync.
Well, this is your opinion. I think that many of what is written there is still valid.
ou can't be serious if you think that it's okay that Opera is saying that data will be encrypted and then not doing it.
Is that so difficult for you to understand that sync data is encrypted during its tranfer between the computer and the sync server but it's not stored encrypted on the server except for passwords?
Btw, found a newer comment from a former Opera employee regarding sync and security of data: http://www.opera.com/blogs/desktop/2015/09/opera-32-privacy-is-a-universal-right-2/#comment-2256300376
-
jryc Opera last edited byHey mikecerm!
There was bug in "Advanced configuration" dialog, wrong string/information about encryption. It has been fixed. Now there are two options named: "Encrypt synchronized passwords with you Opera credentials." and "Encrypt synchronized passwords with your own passphrase." Only passwords are encrypted. If you are using Opera 39 or later you have it fixed. If you have older Opera version, please upgrade to newest, Opera Stable 39, Opera Beta 40, Opera Developer 41.
Cheers! -
mikecerm last edited by
I'm glad to hear that the "bug" has been fixed, but it is unfortunate that Opera has elected to fix it by leaving so much data unencrypted, rather than enabling full sync encryption as Google and Firefox have done. With Opera's sync servers having been recently compromised, it goes without saying that Opera's sync model is horribly insecure, and should be avoided completely. Had Google or Firefox's servers been compromised, no user data would have been put at risk.
-
black-955-tiger last edited by
Stupid question alert?????
What is the passphrase and where does one get it from? I tried to set up this sync thing a couple of days ago and was never asked to create a passphrase. Now in the sync button, top right of the screen I'm being told that I need to enter my passphrase to complete the sync process. Can anyone help please? -
leocg Moderator Volunteer last edited by
What is the passphrase and where does one get it from?
The passphrase is set up by the user itself.
I tried to set up this sync thing a couple of days ago and was never asked to create a passphrase
Then you shouldn't need to use one.
Now in the sync button, top right of the screen I'm being told that I need to enter my passphrase to complete the sync process.
So you login into Sync and it asks you for a passphrase?
-
Deleted User last edited by
As of today (version 40) the "Advanced Synchronisation Settings" dialog gives you two choices: "Encrypt synchronised password with your Opera credentials" or "Encrypt all synced data with your own sync passphrase".
Does option two (ALL SYNCED DATA) really mean that I'm the only one who can access my data?
-
-
mikecerm last edited by
Does option two (ALL SYNCED DATA) really mean that I'm the only one who can access my data?
I just tested it out, and that does appear to be true. If you try to view your synced data at sync.opera.com it now shows that the data is encrypted, where previously the data was visible even if you had chosen to encrypt all data with a passphrase.
Still not sure I'd trust it. I mean, previously Opera claimed to encrypt the data though they weren't actually doing it. If they're that careless with user data (remember, they were also hacked recently), who knows whether they're actually encrypting it now or just saying that they are.
-
Deleted User last edited by
As a user I would really appreciate to know wether it's encrypted all the way or Opera just dropped a few padlock icons to gain trust.
-
-
Deleted User last edited by
How do you know? If you're correct, why does the dialog say "Encrypt all synced data..", and the "auth.opera.com" website tell users that bookmarks etc is encrypted?
-
-
mikecerm last edited by
Synced passwords are encrypted.
Other data only during transition between client and server.That's how it used to work, not how it currently works.
-
mikecerm last edited by
How do you know? If you're correct, why does the dialog say "Encrypt all synced data..", and the "auth.opera.com" website tell users that bookmarks etc is encrypted?
Don't listen to him, he's relying on outdated info. You can get details about what is actually being encrypted at opera://sync-internals/
But ultimately, since Opera is closed source, you have to trust that they're actually doing what they say, and that hasn't always been been true in the past.
-
leocg Moderator Volunteer last edited by
How do you know?
If you read the whole topic you will see some links where you may find those information.
If you're correct, why does the dialog say "Encrypt all synced data.."
This was answered already in this topic. It's a bug on the dialog.
and the "auth.opera.com" website tell users that bookmarks etc is encrypted?
I don't see any mention about it.
-
-
Deleted User last edited by
@leocg Are you seriously saying that you can't see any padlocks or text that says "encrypted" on "sync.opera.com" when browsing your synced bookmarks for example?
-
leocg Moderator Volunteer last edited by
@leocg Are you seriously saying that you can't see any padlocks or text that says "encrypted" on "sync.opera.com" when browsing your synced bookmarks for example?
At sync.opera.com/web I can only see a padlock in 'passwords'.
