Ah, good to know. Ideally it should also derive another key when logging into Sync, so it's never sent verbatim even through a secure channel.

We do :) The full details are at https://github.com/mozilla/fxa-auth-server/wiki/onepw-protoc..., but basically we derive two separate keys: one for authentication, that gets sent over the wire, and a completely different one for decrypting the sync key, which is not set over the wire. This means that even if you can observe the entire transaction, you still aren't able to derive the decryption key.

It's more or less:

    let quickStretchPW = PBKDF2(email, password)
    let authPW = HKDF('authPW', quickStretchPW)
    let unwrapBkey = HKDF('unwrapBkey', quickStretchPW)

Where unwrapBkey !== authPW.

Perfect. So web login does that too, I guess. Therefore as good as before but easier to use. I'm happy I don't need to trust the server.