Firefox Account SyncVM

[R A F]

Hi Everyone,

I'm trying to find a way to sync firefox bookmarks but I do not want to use firefox account. So my question to all of you is:
Does anyone knows if there is a possible way to create local account that will be hosted on standalone VM so I could connect all Firefox Apps to connect to that source ans sync bookmarks, plugins, etc. The whole point here is to keep all bookmarks in safe place that same way some people keep their passwords keys etc.
Maybe if there is no such a solution someone could start new project? I would do that myself, but currently do not have advanced coding skills :-(

Thanks for all replays
BR
Raf

[unman]

Search the archives of this list for discussions on this topic: Firefox
Bookmarks should get you relevant posts, and links to some sample
scripts.
The biggest danger is that your bookmarks will carry identifying
information between qubes, breaking the isolation model. If you plan for
this and are aware of the risks then you can adopt anything between
storing/syncing whole profiles between one "storage" qube and other
qubes, and copy/pasting bookmarks from storage qube in to other firefox
qubes as needed.

[Mathew]

Is sync bookmarks from a firefox account in a Qubes AppVM a bad idea ?

[R A F]

What if this could be done that same way as we keep password using keypass?

Identification that wold by separated don't you think and we could have some more automation ;-)

Raf

--
You received this message because you are subscribed to the Google Groups "qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users...@googlegroups.com.
To post to this group, send email to qubes...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/qubes-users/20190118013837.keqgry63jatpvd5s%40thirdeyesecurity.org.
For more options, visit https://groups.google.com/d/optout.

[22...@tutamail.com]

I am sure there are different opinions out there, but my thoughts would be:

1) Using a "cloud" account to sync is not as secure (somebody can get access, change URLs in your book mark account and your potentially owned)
2) Using other 3rd parties is less secure (Personally I don't trust LastPass, I also don't think it is open source)
3) Using the 'cloud" to circumvent Qubes isolation is less secure (i.e. Password plugin with my passwords in a cloud)

I really like the convenience of a plugin for my passwords but unfortunately I don't want to compromise my security even if it is slightly less...I am open for another opinion!

[unman]

On Sun, Jan 20, 2019 at 07:52:42AM -0800, Mathew wrote:
> Is sync bookmarks from a firefox account in a Qubes AppVM a bad idea ?
>

I think the main issues here are:
Risk of individual bookmarks carrying identifying information.
The range and variety of bookmarks being used to fingerprint users and
correlate between qubes.

[R A F]

I understand your point here but what if I simply do not want to sync my bookmarks, history etc with the cloud. What if I do not want to share those bookmarks between AppVMs. But what if I need to sync this offline inside AppVM that I use in specific domain? The problem here is that in many cases users are forgetting to backup their goodies and not everyone want to sync all this with cloud account. I'm not expert in that area and trying to find out if anyone know it this type of sync is even possible.

Thanks Guys.
Raf

[John Goold]

You could set up a local file server of your own, such as “ownCloud” https://owncloud.org/

[John Goold]

After re-reading the thread, I realized I was over simplifying your question — sorry.

However, after reading your original question more carefully, I am left wondering what exactly it is you wish to accomplish (again, sorry if I am being dim-witted).

It sounds like you are discussing a single computer running Qubes. It is not clear to me whether you want to synchronize bookmarks among instances of Firefox running on different appVMs (doing so would appear to compromise security as discussed elsewhere) or whether you just want to be able to back-up your bookmarks (possibly from multiple appVMs).

Having just recently made the transition to Qubes, I had to migrate my data which included my bookmarks. I did not use Firefox's Sync., to do this, but simply backed up my bookmarks from my laptop computer. I then transferred the backup to my new desktop, Qubes computer. I copied them to the appVMs that I would be running Firefox on. After restoring the bookmarks, I deleted any non-relevant bookmarks from each appVM. For example, I deleted all but the banking/financial bookmarks from the "finances" appVM (and deleted those from every other appVM).

I also made sure that remembering history, passwords, etc., was turned off for Firefox on every appVM. Also, which probably goes without saying, I turned off all reporting back to Mozilla.

I have also decided on my backup strategy being to use Qubes backup to backup VMs (including template VMs) to an external USB drive (accepting there may be some slight USB-related exposure).

So, the bottom line is, what do you really want to do?

If it is just back-ups, then use either Firefox's bookmarks backup/restore or backup the relevant Qubes (or both).

If you really want to synchronize bookmarks among your appVMs, I think you would be needlessly jeopardizing your security with no real gain. Personally I would recommend against doing this.

[Franz]

A "storage" qubes for bookmarks would need to be "charged"  with bookmarks from various other qubes, which is both cumbersome and potentially risky.

So why not use a cloud system, such as the Bookmark app for Nextcloud, which is convenient for that and  seems to be available for Android too. The only risk I see is that the owner of different VMs may be identified as the same. But if the problem is anonymity at this level, then, when required, it is better to use a Wonix qube with a different list of bookmarks.