mirror of
https://github.com/lux-apps/papers.git
synced 2026-10-30 18:15:21 +00:00
zeekay
abf99d05fc
Restructured from flat .tex/.pdf files into per-paper subdirectories. Added Antje Worring as co-author on all papers. Synced PDFs to pdfs/ for download site.
48 lines
2.0 KiB
TeX
48 lines
2.0 KiB
TeX
\section{What Firebase Gets Wrong}
|
|
\label{sec:wrong}
|
|
|
|
Firebase's design makes four architectural choices that are wrong in
|
|
the sense that they sacrifice user sovereignty for developer convenience.
|
|
These are not implementation bugs; they are structural properties of
|
|
the cloud-dependent model.
|
|
|
|
\subsection{The Provider Owns the Data}
|
|
|
|
Firestore data is stored on Google's servers, encrypted with Google's
|
|
keys (customer-managed encryption keys via Cloud KMS are available but
|
|
still require trusting Google's infrastructure for key operations). The
|
|
developer cannot:
|
|
|
|
\begin{itemize}
|
|
\item Verify that a deleted document is actually removed from all replicas.
|
|
\item Prove to a regulator that data has not been accessed by Google employees.
|
|
\item Export data in a format that another provider can import without transformation.
|
|
\item Operate the application if Google's servers are unreachable.
|
|
\end{itemize}
|
|
|
|
\subsection{The Provider Owns the Identity}
|
|
|
|
Firebase Auth identities exist only within Firebase. A user's
|
|
authentication state---their hashed password, their linked social
|
|
accounts, their session history---is a Google-managed resource. If the
|
|
developer migrates away from Firebase, they cannot migrate user identities.
|
|
Users must re-register, re-verify their email, and re-link their social
|
|
accounts.
|
|
|
|
\subsection{No Client-Side Encryption}
|
|
|
|
Firestore provides no mechanism for client-side encryption. Data is
|
|
transmitted in plaintext (over TLS) and stored in plaintext (encrypted
|
|
at rest with Google-managed keys). The developer cannot implement
|
|
end-to-end encryption without abandoning Firestore's query capabilities,
|
|
because Firestore cannot query over encrypted fields.
|
|
|
|
\subsection{No Portability}
|
|
|
|
There is no standard data format, no standard query protocol, and no
|
|
standard authentication protocol that allows a Firebase application to
|
|
run against a non-Firebase backend without code changes. Firestore's
|
|
query language, security rules, and data model are proprietary. The
|
|
switching cost is a full rewrite of the data layer.
|
|
|