[valisystem]

Firefox does it by asking you to enter a code displayed on a device that already has the key. My guess is that the displayed key is used to decrypt the actual key on the device, and that the key is never seen in clear on the network.

[eslaught]

Correct, and not only is it never in the clear over the network, the key is stored such that Mozilla cannot decrypt your content.

https://support.mozilla.org/en-US/kb/firefox-sync-data-secur...