For the record, note that Firefox itself -- code shipped by Mozilla -- still saw your Sync credentials in Sync 1.1. There&#x27;s no way for it to not do so!<p>In theory we could ship a hotfix that steals those, and still could; we wouldn&#x27;t need to do it via the FxA content JS, which would only get to see them during account creation.<p>There is no such thing as perfect security.