See my comment at https://news.ycombinator.com/item?id=11684378 https://news.ycombinator.com/item?id=11684378. The short version is that Mozilla now uses one's

See my comment at https://news.ycombinator.com/item?id=11684378 https://news.ycombinator.com/item?id=11684378. The short version is that Mozilla now uses one's Firefox account password to secure one's synced data — but there are places one enters one's Firefox account password which load JavaScript from Mozilla servers, which means that Mozilla, an employee or a government (or anyone else who can act as mozilla.com …) can serve malicious JavaScript and steal one's Firefox password and all synced data, including browsing history and passwords. This is flat-out unacceptable.