Re: Walkthru of FxA/Sync Account Creation

2014-01-10 Thread Richard Newman
> "Your browser will begin syncing all of your bookmarks, open tabs, history, > passwords, preferences, and add-ons. [customize]" Tiny point of clarification here (and one reason why per-device pref makes more sense to me): preferences and add-ons only sync between apps of the same "kind", and

Re: Tokenserver/FxA-Cert changes for Sync+FxA

2014-01-10 Thread Richard Newman
>> * resetting your account (new password, new encryption key) should *not* >> result in clients seeing HMAC errors, when they try to decrypt new >> records with the old key or vice-versa > > Are we falling into the "let's fix sync while we're at it" trap here? > > HMAC errors are a fact of lif

Re: Helping with sync/fxa interfaces?

2014-01-10 Thread Richard Newman
> This is tricky. > > I'm going to ask Richard to weigh in here. We touched on this briefly in: > > https://bugzilla.mozilla.org/show_bug.cgi?id=949260 > > I need to review the sync again to remind myself how it all works. Got a bug number (or earlier email) to point me to? > On Jan 9, 2014,

Re: Please update the status of your Jan 10 sync relaunch deliverables

2014-01-10 Thread Nick Alexander
On 1/10/2014, 6:25 PM, Nick Alexander wrote: On 1/10/2014, 4:20 PM, Chris Karlof wrote: https://wiki.mozilla.org/User_Services/Sync/Relaunch#Engineering_.2F_QA_Deliverables If you hit them, strike them through and optionally provide details. If you missed them, mark them at risk and provide d

Re: Please update the status of your Jan 10 sync relaunch deliverables

2014-01-10 Thread Nick Alexander
On 1/10/2014, 4:20 PM, Chris Karlof wrote: https://wiki.mozilla.org/User_Services/Sync/Relaunch#Engineering_.2F_QA_Deliverables If you hit them, strike them through and optionally provide details. If you missed them, mark them at risk and provide details. I just pushed an Android try build [1

Please update the status of your Jan 10 sync relaunch deliverables

2014-01-10 Thread Chris Karlof
https://wiki.mozilla.org/User_Services/Sync/Relaunch#Engineering_.2F_QA_Deliverables If you hit them, strike them through and optionally provide details. If you missed them, mark them at risk and provide details. -chris ___ Sync-dev mailing list Sync

Re: Helping with sync/fxa interfaces?

2014-01-10 Thread Chris Karlof
On Jan 9, 2014, at 5:41 PM, Mark Hammond wrote: > I sent this a little too early - the patches are totally flawed :( In > particular, resetSync() isn't the place where we should "reset" the identity > provider - startOver() in services/sync/modules/services.js looks a better > bet (which is e

Re: Tokenserver/FxA-Cert changes for Sync+FxA

2014-01-10 Thread Chris Karlof
On Jan 10, 2014, at 9:14 AM, Toby Elliott wrote: > On possibility that Ryan and I discussed - if the tokenserver gets a new > generation cert, it immediately rejects and backs off all clients of that > account for the token expiry period. That way we can guarantee that when the > writes start

Re: Walkthru of FxA/Sync Account Creation

2014-01-10 Thread Chris Karlof
On Jan 10, 2014, at 8:00 AM, Karen Rudnitski wrote: > > Interested to hear the results of your Android investigation! Hi Karen, When I logged in to Chrome on Android, unlike Chrome on Desktop, it didn't give me any option to select datatypes before it enabled Chrome Sync. It did offer an o

DECISION: COPPA in the FxA account creation flow

2014-01-10 Thread Chris Karlof
We made a decision today in the Sync relaunch standup regarding COPPA in our FxA account creation flow: We do a year picker only during account creation. It is noted that this may unnecessarily exclude some users born in 2001. -chris ___ Sync-dev m

DECISION: Sync datatype selection during login and account creation

2014-01-10 Thread Chris Karlof
During the standup today we made a decision on Sync datatype selection during login and account creation: https://wiki.mozilla.org/User_Services/Sync/Datatype_Selection_Fx29 If this summary is inaccurate in any way, please amend it ASAP, and respond to this email. -chris _

Re: password strength estimators

2014-01-10 Thread Nick Alexander
On 1/10/2014, 10:05 AM, Chris Karlof wrote: On Jan 10, 2014, at 7:39 AM, Ryan Feeley mailto:rfee...@mozilla.com>> wrote: Do think we can fit this in? It looks pretty great. Let's consider it for Fx30+ :) Seconded. I don't want to make this a priority on Android for Fx29. Sorry, Nick ___

Re: password strength estimators

2014-01-10 Thread Chris Karlof
On Jan 10, 2014, at 7:39 AM, Ryan Feeley wrote: > Do think we can fit this in? It looks pretty great. > Let's consider it for Fx30+ :) > On Jan 9, 2014, at 3:00 PM, Chris Karlof wrote: > >> This one is a little better than average, though, :) >> >> https://tech.dropbox.com/2012/04/zxcvbn-r

Re: Tokenserver/FxA-Cert changes for Sync+FxA

2014-01-10 Thread Toby Elliott
On possibility that Ryan and I discussed - if the tokenserver gets a new generation cert, it immediately rejects and backs off all clients of that account for the token expiry period. That way we can guarantee that when the writes start again, every client is using the new key. It's a little ha

RE: Walkthru of FxA/Sync Account Creation

2014-01-10 Thread Karen Rudnitski
> If this idea doesn't make people vomit, I can explore what Chrome Sync > does on Android more. :) > > -chris > I am not vomiting. Interested to hear the results of your Android investigation! ___ Sync-dev mailing list Sync-dev@mozilla.org https://m

Re: password strength estimators

2014-01-10 Thread Ryan Feeley
Do think we can fit this in? It looks pretty great. On Jan 9, 2014, at 3:00 PM, Chris Karlof wrote: > This one is a little better than average, though, :) > > https://tech.dropbox.com/2012/04/zxcvbn-realistic-password-strength-estimation/ > > -chris > > > On Jan 8, 2014, at 3:51 PM, Chris Ka