Private by Design: How We Built Firefox Sync
Sadly, I believe that Firefox Accounts — upon which Firefox Sync is built — are insecure in execution.  The security of the whole system relies on keeping your password secret from Mozilla, but as you can see when accessing <a href="https://accounts.firefox.com/oauth/signin?scope=profile&client_id=3a1f53aabe17ba32" rel="nofollow">https://accounts.firefox.com/oauth/signin?scope=profile&clie...</a> your browser downloads the JavaScript it will use to derive your authentication token from Mozilla.<p>There’s nothing stopping Mozilla from serving all users malicious JavaScript which sends the password in plaintext; there’s nothing stopping Mozilla from serving 1% of users, or even a single targeted user.  They could be forced to do so by a government with control over them; presumably some number of their employees could likewise be suborned by a state or criminal enterprise.<p>This should all be done by code compiled into the browser and triggered from the UI, rather than JavaScript run within a web page.  Yes, Mozilla could also serve malicious Firefox binaries, or even publish malicious Firefox source, but the odds of someone in the world noticing that are significantly higher than a single targeted individual or small number of targeted individuals noticing.<p>Or maybe I’m missing something?  I don’t think I am, though: that Firefox Account page is just HTML served from accounts.firefox.com; it’d be easy enough to just make it a simple form submission and capture the user’s password.  And with the password, the security of the system fails completely: it’s simplicity itself to decrypt all stored data with it.