Hacker News Reader

Comment by drdaeman | Hacker News Reader

I'm disappointed.

Instead of making password management modular, so any password manager capable of certain queries and operations (KeePass, LastPass, Bitwarden, KWallet/Gnome Keyring/libsecret, Microsoft Credentials Management API, Apple Keychain, etc) could become a storage backend with some programming effort... they're doing the exact opposite - they've created yet another password manager UI and yet another proprietary data format (Lockbox Data Storage) for that purpose.

Seriously, I doubt many (if anyone) but Mozilla management needs or wants a Mozilla-branded extra ecosystem, in addition to Google, Apple and Microsoft-branded ones - yet another piece of software that doesn't interoperate with anything but its own unique data formats and protocols.

I don't know what others want, but I want a good browser that I can hook up with things I already use.

View on HN

We either have different definitions of proprietary, or I'm misunderstanding something. The format appears to be open and documented. https://github.com/mozilla-lockbox/lockbox-datastore

Different definitions, I guess. I call it proprietary because it's:

- Unique to Mozilla products. Invented there (disregarding any existing solutions of the same problem) and no one else uses this.

- Based on Accounts and Sync I believe this is not a standard at all, just something that happens to be documented. With FxA&Sync there are a lot of undocumented subtleties and things sometimes change at whim without any warnings. If you make an independent implementation, you're bound to be always catching up, just like it is with any other proprietary protocols.

It's "open" because it's documented and the implementation is FLOSS, but it's also "proprietary" because effectively, Mozilla is in full and ultimate control of this stuff.

They are on day one, sure, but if the file format is documented and clear then there's no reason why other managers couldn't interoperate. It's not as good as using an existing standard, but I'm not sure there is _an_ existing standard right now.

> I'm not sure there is _an_ existing standard right now

I think there is none, except for the OS-provided APIs (but those have complications of their own, e.g. Chrome had dropped Apple Keychain support for a reason).

> there's no reason why other managers couldn't interoperate

Why would they? I don't think anyone was invited to this party. And I find it highly unlikely someone will bother to interoperate beyond implementing an importer tool, because it's likely that no one wants to spend resources on alternative implementations just to be in dependent always-catching-up position.

Seriously, I absolutely don't see how this could become a standard. I've called it proprietary not to badmouth it, but because it is Mozilla's own, unique stuff and is very much likely to remain so.

I believe if someone wants to devise a standard for something, they call for everyone having their in-house implementations, asking if they want to interoperate. Many won't bother, but some may like the idea. Then, a specification is written, and conforming implementations follow.

That isn't what proprietary means, though. Every criticism you level at this file format _can also be levelled at the others_. There's no way around that at this stage. The only way mozilla could not have caused that problem is to not have built anything like this.

> can also be levelled at the others

Password manager storage/exchange formats? Sure, there are no standards at this point. Arbitrary formats or protocols? Certainly not. Similar cannot be said about e.g. HTML/CSS or WebDAV or OpenPGP - even though there are enough incompatibilities, deviations and proprietary extensions.

> The only way mozilla could not have caused that problem is to not have built anything like this.

Of course. I don't think anyone needs yet another password manager, for there are a lot of options already (although many lacking one thing or another, but it's not like Lockbox is going to be the perfect one).

Mozilla are in touch with standard bodies, like W3C. They are participating in development various authentication protocols like FIDO2. Surely they can raise a call for other password management software vendors to devise a common API. Some would not want one (besides importing into their product), some would enjoy a capability to concentrate on some parts of the product but leave others to compatible third-party implementations (e.g. backend/frontend separation).

It's not a bad thing, of course, to build another password manager. I just don't see anything good about this, either.

While a lot of Mozilla's work is great, this seems to be the tendency of every "Test Pilot" project I've seen; NiH and always a reimplementation of ideas there are plenty of alternatives for already, without much consideration for learning from/interop with those alternatives. It's a bit odd: it all seems quite separate and "distant" from the core work I expect from Mozilla.

I think someone in their management has/had a vision of Mozilla as an ecosystem brand, just like Google or Apple. They must've felt big enough to pull it, providing users with all things Firefox (think of Firefox Account).

They hadn't succeeded and had cancelled Firefox OS, but at least the inertia is still there, if not the continued effort to push in that direction.

Just wait until Google releases a more robust one for Chrome. All these other ones will be left in the dust...not looking forward to that day.

Seriously, if you put Mozilla in the same box as Google, Microsoft and Apple, then you are ignoring company culture completely.

Yes, I want a big privacy oriented, non profit organization with strong engineering practices to handle my passwords. This is not Google, Microsoft or Apple.

I only wish Mozilla wasn't American due to the insane laws about "national security".

I'd love to be wrong about this, but I don't see them as privacy oriented - only marketed as such.

Mozilla made it harder for me to handle my passwords. In their effort to not lose market share and to market themselves as ecosystem rather than a browser vendor, they did horrible things to their password storage. Sync1.1 was tolerable. Accounts+Sync1.5 is an abomination. It's bloated beyond reason, full of weird protocols and formats mixed in odd ways. I'm not even remotely a strong engineer but I can't call what Mozilla made there "good engineering".

And I spent some time writing my own implementation of Accounts and Sync, so I believe I can assure myself my opinion is not completely baseless but relies on some first-hand experience (my crappy code is not good engineering - but neither I claim it such)

Reply on news.ycombinator.com