Sync and Firefox Accounts

Firefox Accounts (FxA) is Mozilla's identity service. Sync is the engine that synchronizes bookmarks, history, tabs, passwords, addons, and preferences across devices using FxA-derived keys.

Components

services/
├── fxaccounts/      # FxA client: OAuth, key derivation, device records
├── sync/            # Sync engine: collection logic, conflict resolution
├── crypto/          # Key derivation, kSync, kXCS
├── settings/        # Remote Settings (OneCRL, blocklists, experiments)
├── automation/      # Automation hooks
├── common/          # Shared modules
└── interfaces/      # IDL definitions

Sync architecture

graph LR
    UI[Sync prefs UI] --> Engine[Sync engine<br/>services/sync]
    Engine --> Engines[Per-collection engine<br/>(bookmarks, history, ...)]
    Engines --> Tracker[Tracker: notes changes]
    Engines --> Store[Store: read/write Places, etc.]
    Engine --> Crypto[KeyBundle, AES-256, HMAC]
    Crypto --> FxA[FxA token]
    Engine --> Server["Sync 1.5 server (Mozilla-hosted)"]

Each collection has its own engine (services/sync/modules/engines/):

• bookmarks.js
• history.js
• tabs.js
• addons.js
• passwords.js
• prefs.js
• creditcards.js
• addresses.js

Application Services / Rust

Mozilla also maintains a separate Rust Application Services project (mozilla/application-services on GitHub) that ports several Sync engines (Logins, Places, Tabs, …) to Rust for use across desktop, Android, and iOS. Bindings to those crates live under services/ and mobile/android/components/.

Firefox Accounts

services/fxaccounts/ implements:

• OAuth-style token exchange.
• Web-channel handshake with accounts.firefox.com.
• Device record management (used for Send Tab and Sync identity).
• PBKDF2 key derivation from password to kSync.

Related

• Storage
• DOM credentials (passwords UI)