> If you're talking about the Firefox Sync password, it's being derived and what Mozilla gets is not your password. Derived by JavaScript served by … Mozilla.

> If you're talking about the Firefox Sync password, it's being derived and what Mozilla gets is not your password. Derived by JavaScript served by … Mozilla. They can, at any time, serve JavaScript which submits your unhashed passphrase straight to them. > If you can't trust an open-source application managed by a reputable non-profit, then you definitely can't trust your operating system either, in which case it is better to not have a smartphone at all. There's a difference between trust once and trust always. An OS is downloaded once; an application is downloaded once; JavaScript is downloaded every time you need it (modulo caching, of course): Mozilla can be compelled to suborn that JavaScript at any time in order to target someone.