hi Checkmate, the whole security architecture of the service is documented at https://github.com/mozilla/fxa-auth-server/wiki/onepw-protocol if you're interested in the technical details.

i'd say it's designed with security as the most important factor in all aspects - to the detriment of usability (we regularly get support requests from people who have forgotten their account passwords or access to their 2nd factor device without any saved recovery codes, but there's no possible way to have their data restored)...

Thanks a lot. Highly appreciated. As an aspiring cybersecurity professional I am very interested about what security precautions services use that I use on a daily basis.