Describe "Sync Support"

[ewhac]

The 1.0.0 release mentions it now has "sync support."

For the more paranoid among us, please describe this in more detail -- what is being synced, to where, and when.

[heavensrevenge]

"Sync support" has been around since 2012 here: 6af8f19, it is simple, but I have changed it quite a bit since then, my recent modernizing of the codebase has broken sync numerous times, thus me needing to keep fixing it.
We use the Stanford JavaScript Crypto Library (sjcl.js) since we have existed far longer than the new browser encryption API, but I have been wanting to port to the new native browser encryption API soon enough.

1. Set sync password, the password you chose is PBKDF2 iterated 10,000 times by default
2. Only your profile data gets encrypted with the PBKDF2'd sync password you set, your master password is never synced, it stays 100% local
3. Your profile templates are then synced to the browser sync vendors servers, encrypted, but available on any extension instance you log into both the browser and the extension where you use the same sync password.
4. Profile data customization is the only data which gets synced, extension options are not synced even though it wouldn't hurt if they were, I might sync all settings minus your master password in the future but haven't yet.
5. Profile settings are synced immediately after you save a change to your configured profiles if you have sync enabled.

Bottom line, only your profile templates are synced, after being encrypted by the extension locally, your master password is NEVER synced and NEVER leaves your local machine, your sync password can be different than your master password. Also, if you store your master password "on disk" it is also encrypted, your master password never exists in plain text other than where you type it into the extension popup.

[ewhac]

Thank you. Might want to put that in the docs somewhere.

[heavensrevenge]

I've put this directly into the information section in the extension options page, as sync is one of the most feared bits of functionality.