> Firefox Sync encrypts your data with a password-derived key so that Mozilla can't even see your browsing history.

Not quite true: the JavaScript (!) that derives the key is served from mozilla.org; at any time they could choose or be compelled to alter it so that all users' passwords, or a single targeted user's password, is sent to Mozilla or anywhere else.

The new Sync protocol is an abomination; the old one was actually secure; the new one is snake oil.