Mozilla uses server-hosted JavaScript to 'secure' user passwords

Ah, good to know, but still not good. The whole point of a secure password-storage mechanism should be that all they can do is delete passwords, not decrypt them.

> Also, if you think there's a security issue, maybe file it on Bugzilla before HN.

I took a look at Bugzilla, but it looked like a pain to sign up and I couldn't tell quickly where & how to file security issues vice bugs.

And to be honest, I was also a bit angry about how they completely removed the brilliant crypto they used to use. Given that they seem to think that this reduction in security is perfectly acceptable, I figured that publicity was more likely to effect change.