This means that at any time Mozilla can replace that JavaScript and steal end-user passwords. Anyone who can successfully MITM Mozilla (i.e., anyone with a tru

This means that at any time Mozilla can replace that JavaScript and steal end-user passwords. Anyone who can successfully MITM Mozilla (i.e., anyone with a trusted certificate: this includes CNNIC, the Government of the Netherlands, the Government of Spain and others, as indicated in https://wiki.mozilla.org/CA:IncludedCAs https://wiki.mozilla.org/CA:IncludedCAs) can successfully do the same. And yes, this means that anyone with a Lenovo laptop who changed his Firefox Account password must now change every single password he has ever synced, even if he's never logged onto a particular site with that laptop.