Mozilla rolls out recovery key option for Firefox accounts

Mozilla added support for TOTP two-factor authentication earlier in May.
Written by Catalin Cimpanu, Contributor

Mozilla announced today a new recovery option for Firefox Accounts, the user system included inside the Firefox browser. Starting today, users can generate a one-time recover key that will be associated with their account, and which they can use to regain access to Firefox data if users ever forget their passwords.

Firefox Accounts is included with all recent versions of the Firefox browser. Most users are familiar with it because of Firefox Sync, the system that synchronizes Firefox data such as passwords, browsing history, open tabs, bookmarks, installed add-ons, and general browser options between multiple Firefox instances.

But while Sync does the actual synchronization, Firefox Accounts is at the core of Sync and is the system that manages the identities of Firefox users.

Image: ZDNet

Sync works by taking a user's Firefox account password and encrypting the user's browser data on the local computer. Only after this data is encrypted is this data sent to Mozilla's servers for storage, amking sure that Mozilla engineers can't access this information without the user's password, which serves as a decryption key.

Also: Just how fast is Firefox Quantum?

In scenarios where a loses a laptop or has his phone stolen, if he installs Firefox on a new device, he can't download and decrypt his previous browser data without his Firefox account password.

But starting today, Mozilla has rolled out a feature called a "recovery key" for Firefox Accounts. Users can generate a recovery key, which serves as a secondary decryption key for their data, in case they forget their Firefox account password.

The Firefox recovery key is similar to the recovery codes provided during two-factor authentication setup at most online services. Firefox users will have to write them down on a paper, or keep them inside a file (preferably encrypted) somewhere online or on a secondary device.

Mozilla says a recovery key can be used only once, and users will have to generate a new key after they spend the previous one. Instructions on how to generate these keys are provided on this Firefox support page.

Also: Firefox Quantum: A cheat sheet for professionals TechRepublic

But Mozilla also advises that users install Firefox on more than one device, so in the case they lose access to one, they can still use the others to reset passwords or synchronize locally stored data to a new account and make sure the data doesn't get lost forever.

Earlier this year, in May, Mozilla also rolled out two-factor authentication support for Firefox Accounts. Mozilla didn't support the somewhat insecure SMS-based 2FA system, but TOTP, or Time-based One-Time Passwords, which can be generated using various authenticator apps.

These are 2018's biggest hacks, leaks, and data breaches

Previous and related coverage:

What is malware? Everything you need to know

Cyber attacks and malware are one of the biggest threats on the internet. Learn about the different types of malware - and how to avoid falling victim to attacks.

Security 101: Here's how to keep your data private, step by step

This simple advice will help to protect you against hackers and government surveillance.

VPN services 2018: The ultimate guide to protecting your data on the internet

Whether you're in the office or on the road, a VPN is still one of the best ways to protect yourself on the big, bad internet.

FBI solves mystery surrounding 15-year-old Fruitfly Mac malware

Fruitfly malware author used port scanning with weak or no passwords to identify potential victims.

Meet Torii, a new IoT botnet far more sophisticated than Mirai variants

The evolving IoT botnet is able to compromise an impressive array of architectures.

Teenage Apple hacker avoids jail for 'hacky hack hack' attack

The self-proclaimed Apple fan stole roughly 90GB of confidential data from the iPad and iPhone maker.

Related stories:

Editorial standards