> I believe that's how Weave worked. The newer Firefox Sync included (still includes?) sharing capabilities that call that into question.

A quick search online makes it seem like Mozilla still has no ability to read what you sync. E.g. from https://en.wikipedia.org/wiki/Firefox_Sync you see:

> It keeps user data on Mozilla servers, but according to Mozilla the data is encrypted in such a way that no third party, not even Mozilla, can access user information. It is also possible for the user to host their own Firefox Sync servers, or indeed, for any entity to do so.

I can't find independent verifications, but I would trust Mozilla about this at this point. But I'm not sure what sharing capabilities you refer to so I can't really speak to that.

In hindsight looks like I misunderstood the reason behind this new derived key system [0]. Looks like it was more about not losing access than sharing.

[0] https://blog.mozilla.org/services/2014/02/07/a-better-firefo...