@yoasif E2EE, until your password for Firefox Accounts gets compromised (anyone with the FxA password can decrypt your sync key stored in Mozilla's servers. Even if their device is not synced and the account has no synced devices). And knowing that many people will still reuse their passwords across different services, this is not a remote possibility. Mozilla can still be forced by authorities to hand over a user's sync key, and if said authorities know that their target has likely reused their password for Firefox Sync with another website that got a breach, well that user can just hope that there's nothing incriminating in the synced data...
They shouldn't have replaced Sync 1.1 (aka Weave) with its J-PAKE where the sync key never leaves the synced device (the only thing the server will have is encrypted data it can't read, even if the sync password gets compromised).
@fizzo @jbz
They shouldn't have replaced Sync 1.1 (aka Weave) with its J-PAKE where the sync key never leaves the synced device (the only thing the server will have is encrypted data it can't read, even if the sync password gets compromised).
@fizzo @jbz