I am considering switching over to Brave and maybe also use it's sync feature for settings, and maybe even passwords if it's good enough. I do use a password generator but out of laziness I happen to sometimes store passwords locally.
In their FAQ they state that they use a seed that's then stretched with scrypt(N = 2^13, r = 8, p = 11). This is the first head scratcher. According to C.Percival, the KDFs creator, in 2017(!) 32k iterations should be made, iirc the recommended parameters back then were (N=32768, r=8 or 16, p=1).
Second, they use AES128-CTR-HMAC, which is not listed by SSL Labs best practices.
The question is, does any of this matter? Why, why not? Would you deem Brave Sync secure enough to use for syncing passwords across devices, given that my devices are properly protected and I only sync passwords to accounts that matter less or that have 2FA if they do matter?
EDIT: As has been pointed out, in the comments, there's nothing wrong with AES128-CTR and the scrypt parameters mentioned above were specified in regard to interactive logins, where (usually weaker) user-passwords are hardened instead of a generated seed.
However it still seems weird to me that a task that often requires multiple executions per second(sending packets via TLS) often employs "stronger" encryption schemes(AES-256 GCM has got to be stronger than the suite used, even if it only comes down to the doubled key-size) than this Brave Sync, even though the latter most likely isn't executed that often; maybe only on demand/after a change. Here waiting for 5 seconds to pack/unpack should be easily tolerable. I just don't see why you wouldn't use rather high parameters when sending user's unhashed(!) passwords around.