> We can run our own Firefox Account servers. Which can themselves be compromised. The old Firefox Sync protocol was immune to remote compromise, completely a

> We can run our own Firefox Account servers. Which can themselves be compromised. The old Firefox Sync protocol was immune to remote compromise, completely and totally. > People get annoyed of being told x-y-z is not secure, while not being offered any practical solution I agree: the problem is that there was a practical solution: just keep the old Sync protocol. > I'm assuming Firefox has a good reason for working the way it does The short version is that people wanted to be able to only have one device and still get at their data, and Mozilla didn't want to confuse them by separating their account passwords and their sync passwords. Never mind that combining them has results in a wholesale loss of security.