See my comment at <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=11684378" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=11684378</a>.<p>The short version is that Mozilla now uses one&#x27;s Firefox account password to secure one&#x27;s synced data — but there are places one enters one&#x27;s Firefox account password which load JavaScript from Mozilla servers, which means that Mozilla, an employee or a government (or anyone else who can act as mozilla.com …) can serve malicious JavaScript and steal one&#x27;s Firefox password and all synced data, including browsing history and passwords.<p>This is flat-out unacceptable.