@leocg Are you seriously saying that you can't see any padlocks or text that says "encrypted" on "sync.opera.com" when browsing your synced bookmarks for example?

At sync.opera.com/web I can only see a padlock in 'passwords'.

Are you using a passphrase? If you aren't, then it would make sense that nothing but passwords are being encrypted -- basically how it's always been. If you are using a passphrase, maybe it's just not encrypting anything else because you set up Opera Sync before Opera changed how Sync works. If that's the case then you might want to reset Sync and start over. Then again, if you were using Sync before now -- with or without a password -- you clearly don't care about security/privacy anyway.

How do you know? If you're correct, why does the dialog say "Encrypt all synced data..", and the "auth.opera.com" website tell users that bookmarks etc is encrypted?

Don't listen to him, he's relying on outdated info. You can get details about what is actually being encrypted at opera://sync-internals/

But ultimately, since Opera is closed source, you have to trust that they're actually doing what they say, and that hasn't always been been true in the past.

Synced passwords are encrypted.
Other data only during transition between client and server.

That's how it used to work, not how it currently works.

Does option two (ALL SYNCED DATA) really mean that I'm the only one who can access my data?

I just tested it out, and that does appear to be true. If you try to view your synced data at sync.opera.com it now shows that the data is encrypted, where previously the data was visible even if you had chosen to encrypt all data with a passphrase.

Still not sure I'd trust it. I mean, previously Opera claimed to encrypt the data though they weren't actually doing it. If they're that careless with user data (remember, they were also hacked recently), who knows whether they're actually encrypting it now or just saying that they are.

I'm glad to hear that the "bug" has been fixed, but it is unfortunate that Opera has elected to fix it by leaving so much data unencrypted, rather than enabling full sync encryption as Google and Firefox have done. With Opera's sync servers having been recently compromised, it goes without saying that Opera's sync model is horribly insecure, and should be avoided completely. Had Google or Firefox's servers been compromised, no user data would have been put at risk.

As he FAQ says,

That 2-year-old FAQ is has nothing to say about the current state of sync.

You can't be serious if you think that it's okay that Opera is saying that data will be encrypted and then not doing it. You can't seriously think that it's okay that Opera copied the sync feature wholesale from Chromium, and removed all of the privacy and security, but left in place the the claims about privacy and security.

That FAQ is so outdated that none of what it says is applicable at all the the current version of sync. As far as I'm concerned, the only line that matters is this one:

If we later decide to sync sensitive private data, such as passwords, we will encrypt that as well.

They are syncing all sorts of sensitive private data and not encrypting it. They didn't used to sync this stuff, and now they are, but they're not encrypting it like they said they would and, more importantly, like they currently say they are. Yes, the current version of the client -- not some 2 year old FAQ from before the sync feature was anywhere close to complete -- says that all sync data will be encrpyted using the passphrase. Furthermore, it didn't always say this. When version 32 was released 9 months ago, the first version to support passwords syncing, the setup said that only passwords would be encrypted. http://betanews.com/2015/09/15/opera-32-adds-password-sync-improved-bookmarks-view/

In the time since then, there was a change made to the setup, and they now say that they are encrypting everything, but they are not actually doing it. So, if they are not encrypting everything, then why did the update the wording within the sync UI to say that they are? Was it simply to mislead users into enabling the insecure sync feature? Was this done so that Opera's new Chinese masters could gather all that data? Is there some other explanation?

Well, i can't access/view my passwords on that page

What about all of your other synced data? As I mentioned above, the setup for Sync says, "encrypt all synced data with your own master passphrase." It does not say, "only your passwords will be encrypted," which is what it used to say. Then it was updated. When I signed up, it said, "all synced data will be encrypted," just as it says today. If it had not said "all data," I would never have signed up.

opera://sync-internals/

Interesting, I didn't know that page existed. Clearly, Opera is just reusing the sync engine from Chrome (or Chromium), because that page looks virtually identical in Opera as does its counterpart in Chrome. The one key differentiator: the part that details "encrypted types." In Opera it only says passwords, whereas Chrome lists, "Bookmarks, Preferences, Passwords, Autofill Profiles, Autofill, Autofill Wallet Metadata, Themes, Typed URLs, Extensions, Search Engines, Sessions, Apps, App settings, Extension settings, App Notifications, Dictionary, Favicon Images, Favicon Tracking, Articles, App List, WiFi Credentials."

So, Opera actually is lying after all. The setup says that all data will be encrypted, but they're only encrypting passwords. So, is this deliberate deception, or just a bug? Either way, it's a massive privacy violation.

Attack?

Yes. An ad hominem attack is a term of art for when you attempt to refute a valid point by attacking the character of the person making it, e.g., "if you think that Opera is untrustworthy, maybe you just have problems trusting." Saying such a thing has no relevance to the legitimate issue I am raising.

However, we can't say for sure if the pass-phrase is to be asked or not.

If the passphrase is used to encrypt the data, then it must be used to decrypt the data. It's as simple at that. If Opera is able to display my information on https://sync.opera.com/web/ without asking me for my passphrase, then the passphrase was not used to encrypt the information. The only other explanation would be that Opera is storing the passphrase in their server and using it to decrypt the data, which they explicitly state they will not do, not to mention it would defeat the purpose of the passphrase entirely, i.e., if you leave the key in a lock, then anyone can just come along and turn the key.

old and somehow outdated FAQ on Sync

Exactly, old and outdated, makes no mention of a passphrase. Not helpful at all. However, it does say, "if we later decide to sync sensitive private data, such as passwords, we will encrypt that as well." And maybe they are encrypting it, but they're definitely not using the passphrase to do it, as I have proven.

Bottom line: the entire point of the passphase is that the encrypted data can only be decrypted by the person with the passphase. Opera says "all synced data will be encrypted with the passphrase," and they plainly are not doing it. If Opera is doing any encryption at all, which remains to be seen, then Opera is using a key that Opera controls, not the passphrase that is known only to the user. This means that Opera has the ability decrypt all synced data, and the passphrase is completely useless.

Well, if you think this way then it seems to me that you have a problem of trusting

This is a rather bizarre ad hominem attack. I mean, I've just demonstrated to you conclusively that Opera is deliberately misleading users about privacy, and you accuse me of being a weirdo with trust issues. Do you think you're being helpful? Obviously, I trusted Opera enough to use the browser. Before the "secure passphrase" was implemented, I didn't use sync because of the inherent privacy implications. When Opera began claiming that the synced information would be securely encrypted, I thought, "hey, I trust these guys know what they're doing, let's give this a shot!" I took them at their word that the information would be encrypted, and it is not. So, this has nothing to do with an inability to trust, and everything to do with the fact that Opera is saying that they're doing something, and they're obviously not doing it.

Even the pass-phrase is not a guarantee of protection

Obviously, Opera claims that it is used to secure the information. Sure, there could be some bug or flaw in the way they implemented the encryption, but I thought at least an attempt would be made to encrypt the information they said they were going to encrypt, you know, at a minimum. I never once thought they would just be outright lying, and not doing any encryption at all.

Privacy is a serious issue, and Opera claims that they take it seriously. If they are lying about this, then what else might they be lying about?