16 ms·
We're Baking ‘Have I Been Pwned’ into Firefox and 1Password
- lvh 8y agoThis uses HIBP for the underlying dataset. I'm not sure what's added though. Convenient UX? They claim to only send anonymized data out, but HIBP already supports the underlying hash range queries -- that doesn't appear to be new here.
- nachtigall 8y agoThe blog article on HIBP goes a bit into more technical detail: "We're Baking Have I Been Pwned into Firefox and 1Password" https://www.troyhunt.com/were-baking-have-i-been-pwned-into-firefox-and-1password/ https://www.troyhunt.com/were-baking-have-i-been-pwned-into-...
- JadoJodo 8y agoI suspect it'll warn you if any of the accounts you've saved in Firefox (username/password) have been compromised. 1Password already does this¹ but this is likely the Firefox implementation of it. ¹ - https://blog.agilebits.com/2018/02/22/finding-pwned-passwords-with-1password/ https://blog.agilebits.com/2018/02/22/finding-pwned-password...
- yjftsjthsd-h 8y agoIn this case, convenience is huge.
- systoll 8y agoThe main thing added here is a brand and some advertising, but that's not insignificant. Haveibeenpwned is a good service but it looks a whole lot like http://ismycreditcardstolen.com/ http://ismycreditcardstolen.com/ on first glance. If the Mozilla brand gets it to more people, that's a win.
- snowwolf 8y agoThis also has anonymized email lookup (using the same model as passwords) that is new.
- ccnafr 8y agoMozilla has wasted a bunch of resources creating a pointless tool. Let me explain why! Last year, they promised to create an add-on that triggered when you visited sites known to have been breached in the past, and let the user check if his password was included in the leaked data, via HIBP: https://www.bleepingcomputer.com/news/security/firefox-will-warn-users-when-visiting-sites-that-suffered-a-data-breach/ https://www.bleepingcomputer.com/news/security/firefox-will-... Now, they announced Firefox Monitor, which is nothing but a standalone website where you can check your email and see if it's been included in public breaches. This is the same functionality of the main HIBP website. If people want to check if their email was included in a breach, they'd just visit HIBP, not Firefox Monitor. Why does this website exist in the first place? They took a good idea that used a proactive approach to alerting users of potentially leaked passwords and they've created a Firefox-branded HIBP clone website that very few people are gonna know about or even use. Pointless use of resources, when they could have used them for something actually useless.
- qaz_plm 8y ago>> ...that very few people are gonna know about or even use "This is major because Firefox has an install base of hundreds of millions of people which significantly expands the audience that can be reached once this feature rolls out to the mainstream." https://www.troyhunt.com/were-baking-have-i-been-pwned-into-firefox-and-1password/#mozillaandfirefoxmonitor https://www.troyhunt.com/were-baking-have-i-been-pwned-into-...
- kadenshep 8y agoYou're ignoring how most users need things in front of their face. Most users are not privacy or security "aware" in any manner. Putting it in the UI or actively promoting these services is beneficial to the common web user. And if it fails, it's at least worth it to learn why it failed. Was the UI bad? Did it not promote the service in the right way? Did users not understand the purpose of the tool? I think the juice is worth the squeeze.
- tomc1985 8y agoAnd then everyone suffers through even more intrusions on their workflow because Johnny Newbie doesn't care
- cbhl 8y agoI'm worried that this will just train people to start blindly clicking through "pwned password" modal dialogs for CVVs and OTP/SMS 2FA codes, just like they did for the "Do you want to view only the webpage content that was delivered securely?" dialog in MSIE.
- deleted 8y ago[deleted]
- BartBoch 8y agoThe wide public is not so interested in secured content really imo, but they will rarely ignore warnings about their passwords. The password is like a pin for your debit card. You don't mind people seeing your card (unsecured content), but you will not share your pin code (password).
- zrobotics 8y agoNext time you are in a checkout line, pay attention to how few people make any attempt to prevent shoulder surfing their PIN. POS devices have gotten better with shielded keypads, but there are still many machines that make it somewhat difficult to obscure your PIN. The average person gives very little thought to security, or at the very least gives little thought to possible threat models.
- jvehent 8y agoAs many have commented, this isn't a new tool for technologists. The goal of Firefox Monitor is to bring this functionality to non-technical users, which requires a lot of user experience research to inform without scaring people away from using the internet.
- robertAngst 8y agoMozilla PR/marketing team all over the web for the last few weeks...
- ngokevin 8y agoHelps they have hundreds of employees to upvote the posts on HN too. I've been there :)
- robertAngst 8y agoThis would explain their brigading of topics on reddit.
- no_carrier 8y agoAnd apparently the downvotes!
- sanat 8y agoCongratulations @troyhunt Your project's making a bigger difference around the world.
- deleted 8y ago[deleted]
- zeroisnowfour 8y agoA much more honorable way to do this would have been to allow the search of a hash of your email rather than your actual email.
- rhencke 8y agoThat's... exactly what they're doing?
- zeroisnowfour 8y agoDouble-checking source code @ haveibeenpwned.com. I see no javascript that hashes your email address before submission.
- NoKnowledge 8y agoThey do that, with the extra step of allowing k-anonimity (https://www.troyhunt.com/were-baking-have-i-been-pwned-into-firefox-and-1password/#enablinganonymoussearcheswithkanonymity https://www.troyhunt.com/were-baking-have-i-been-pwned-into-...)
- crb002 8y agoMake sure to not do it automatically, but on user interaction (like new Safari password fills). Otherwise you leak usernames and tie them to browser sessions which can be fingerprinted.
- deleted 8y ago[deleted]
- jasontedor 8y agoI think this is addressed by the use of k-anonymity which is described in the section of the article titled “Enabling Anonymous Searches with k-Anonymity”.
- homakov 8y agoInstead of actually fixing authentication they are baking "have this password been exposed in plaintext" into the browsers. What's the deal with WebAuthN? Such a basic functionality still not completed.
- JumpCrisscross 8y ago> Instead of actually fixing authentication they are baking "have this password been exposed in plaintext" into the browsers “Perfect is the enemy of good” [1]. [1] https://en.m.wikipedia.org/wiki/Perfect_is_the_enemy_of_good https://en.m.wikipedia.org/wiki/Perfect_is_the_enemy_of_good
- detaro 8y agoI thought Firefox supported Web Authentication API since Version 60, as much as a standard that isn't finished yet can be supported?
- Piskvorrr 8y ago"Fixing." Don't ask me how many sites are still only supporting Basic Auth, in 2018 - I frequent several. How is FF ("they") supposed to fix that?
- homakov 8y agoI don't recall any popular website using Basic Auth. FF must implement WebAuthN or whatever was last offered to fix auth. Have i been pwned brings nothing new to the table.
- mattdennewitz 8y agoExcellent need, more than enough reason to switch. Now bake 1Password into Firefox.
- cpeterso 8y agoNot quite 1Password, but Mozilla is developing a cross-platform password manager, tentatively called "Lockbox", that will support Firefox, Android, iOS, and possibly a Chrome extension. https://mozilla-lockbox.github.io/ https://mozilla-lockbox.github.io/
- jeena 8y agoPlease for heavens sake don't! Isn't it enough to have a binary blob for DRM? I don't want to have another binary blob in my firefox. And especially one which takes all my passwords and sends it to some companies cloud. You can't know what happens with this data because all parts are propriatary. I can't trust a binary blob with all my passwords.
- deleted 8y ago[deleted]
- bunkydoo 8y agoyou guys are the hugest fucking idiots ive ever come across
- bunkydoo 8y agoasdfasdfasdfasdfasdf
- bunkydoo 8y agoDGDSFGSDFGDSFGDSFGDSFGDSFGDSFGDSFGKFHJGHH346246456425623451345345123451235134512345456425624562345
- arthurfm 8y agoOne feature I wish HIBP had was support for sub-domain addressing [1] and plus addressing [2]. My main email address has the format 'example@fastmail.fm' and receives alerts from HIBP if found in a data breach, but all of the related subdomain-based email addresses do not (e.g. netflix@example.fastmail.fm, google@example.fastmail.fm etc.) Based on the 1Password screenshots in the linked article it would appear that specific support for sub-domain/plus addressing may not be required? However, Firefox Monitor looks like it has the same limitations as the HIBP website/API and makes the alerts somewhat less useful when using sub-domain/plus addressing. [1] https://www.fastmail.com/help/receive/addressing.html https://www.fastmail.com/help/receive/addressing.html [2] https://haveibeenpwned.uservoice.com/forums/275398-general/suggestions/6774229-enable-search-and-notifications-for-email-addresse https://haveibeenpwned.uservoice.com/forums/275398-general/s...
- bad_user 8y agoYou can sign up to get notifications for an entire domain, meaning that you can get notifications for any email with the "example.fastmail.fm" domain. See here: https://haveibeenpwned.com/DomainSearch https://haveibeenpwned.com/DomainSearch
- arthurfm 8y agoThanks! I will give that a try.
- pgl 8y agoThis has been addressed: https://haveibeenpwned.uservoice.com/forums/275398-general/suggestions/6774229-enable-search-and-notifications-for-email-addresse https://haveibeenpwned.uservoice.com/forums/275398-general/s...
- aduicag 8y agoMore bloat, thanks Mozilla
- xiconfjs 8y agoSo will this feature only be available in the web-version of 1password and not in the stand-alone version? :(
- flamtap 8y agoThe latest versions of 1Password (I’m on 7) have great HIBP integration. Really pleased with it so far.
- OnlyRepliesToBS 8y agopls stop
- NVRM 8y agoYou had been pwned anyway.
- NVRM 8y agoEverything said that isn't politically correct is systematically downvoted here on «hacker» news. I am enjoying your very low knowledge and your smartphone attitude. LOL
- detaro 8y agoYou sure it's not you posting trite, basically irrelevant one-liners that's presenting a "smartphone attitude"? Nothing is politically incorrect about your post, but it doesn't add to the discussion.
- auslander 8y agoYeah. There is a flaw with voting stuff in HN, you have to keep yourself 'in party line' to get votes, or to keep yourself from being downed.
- auslander 8y agoLeave the Firefox alone, please. Pocket, HIBP, 1Password, Cloudflare ... Not cool. 1Password has flawed sec rep [0], Cloudflare is pure MITM, stripping TLS between you and webserver, the rest just network and data leaks I haven't asked for. For passwords best is KeepassXC, sync encrypted db via any file sharing. [0] https://www.theregister.co.uk/2017/02/28/flaws_in_password_management_apps/ https://www.theregister.co.uk/2017/02/28/flaws_in_password_m...
- benbristow 8y agoWhat will happen when Have I Been Pwned gets Pwned? Must be storing a lot of email addresses at this point.
- msh 8y agoIt is storing leaks so the data on the site is allready public one way or another.
- crtasm 8y agoIt also has emails of people who sign up to its 'alert me if this address is found in future leaks' service.
- ComodoHacker 8y agoThey are compromised anyway. They just will be compromised once more.
- auslander 8y agoIt reads like a press release. Praises for Troy, Troy praises 1Password and Cloudflare, great sell to naive Mozilla. Shareholders pat themselves on the backs. Champagne, sir?
- coldtea 8y agoAnd that's bad because? And Mozilla is "naive" because? What's the angle? "Stick it to the Man", and stuff?
- auslander 8y agoSecurity is hard. Adding 3rd party systems you don't control is not the way.
- superflyguy 8y agoI use Firefox. Are you saying I'm now less safe? If I'm more safe but some other people don't like the solution then I guess they can configure or fork Firefox then we're all happy, right?
- pbhjpbhj 8y agoArguably, if Firefox is devoting resources to this then it's not got resources to spend on other issues. That could in theory make it less secure. HIBP and 1Password aren't making FF more secure, chances are they're increasing attack surface in both directions (ie making compromise of 1Password more likely too).
- yAnonymous 8y agoMy problem with haveibeenpwned is that when you haven't been pwned, you've just handed them your mail address. Is there anything to alleviate those concerns other than "trust us, we're not saving emails from queries"?
- superflyguy 8y agoI think a lot of people have my email address. You don't hear people worrying about spam so much these days (other than people who have the time and inclination to run their own mail servers). So it would seem to be a small price to pay to keep tabs on your passwords.
- oblio 8y agoWell, if you don't trust them, obviously just don't use it. If you do half-trust them, if they're reasonable, they don't store the email addresses. They don't need to, for a simple search.
- auslander 8y ago> just don't use it But the post is about integrating it into the browser, isn't it?
- _pmf_ 8y agoWhat could possible go wrong?
- Piskvorrr 8y agoShooting the messenger, that's what. People tend to confuse "X might have your password" and "Y tells me 'something X something password', therefore Y hacked me".
- 2T1Qka0rEiPr 8y agoI have such great respect for Troy and all the work he's done/is continuing to do to promote good security practices. I just went on HIPB though and noticed the advise for better security is "use 1Password" (after checking your email for compromises). This just seems a little too commercial to me and I'm not sure I like the phrasing. I fully understand the need for Troy to be sponsored and it's great that 1Password works well with his tooling, but it's not the only solution. I'd feel a little less uneasy if it was phrased in such a way as "Use a password manager, like 1Password".
- BartBoch 8y agoThis. I am using LastPass for example, because it is probably only password manager, where you can completely disable auto-fill (you need to click on an input field and then pick a profile - so it is "on demand" fill) which makes automatic harvesting attacks much harder. I have switched from 1Password exactly for that reason - 1Password is very aggressive in filling input fields for you.
- Cynddl 8y agoBitwarden has auto-fill disabled by default, and only enables it with a warning (“Use at your own risk”).
- BartBoch 8y agoGood to know, the more alternatives the better.
- jplatte 8y agoThe KeePassXC browser integration also does it the way you describe where you choose a profile instead of having the firm already filled in when the page loads.
- joshvm 8y agoIs this new behaviour? In the version of 1Password I have (6.8.8, Mac) it detects the website, but I have to click on the specific login using 1Password Mini to fill the fields. It's never done it automatically as far as I can tell. It tends to be browsers which are gung-ho about automatically filling in login details.
- ThePhysicist 8y agoI recently wrote a small tool to download the whole password database from HIBP and turn it into a Bloom filter that can be used from Golang or Python. The tool also includes a webserver that lets you check for plaintext password matches (only recommended over a secure network) and SHA1 values: https://github.com/adewes/have-i-been-bloomed https://github.com/adewes/have-i-been-bloomed The filter is about 1.7 GB in size with a 10e-6 false positive rate, so it can be used even on moderate hardware to check user passwords against the database (the entire filter must be loaded into memory currently, though it would be possible to use a memmapped file).
- amelius 8y agohttps://www.reddit.com/r/Jokes/comments/1v4bpa/passwords/ https://www.reddit.com/r/Jokes/comments/1v4bpa/passwords/
- throwawaymath 8y agoYou don't need to download them from HIBP. You can freely download all major breach databases from databases.today. There really aren't many passwords not represented in those databases which are present in others, but for everything else you can just automatically download grab dumpmon like Hunt does. Also, try google dorking site:vk.com/doc and "@gmail.com"...there are many large password and email databases you can find that way which have not been publicized. This includes many which are not in HIBP. I've tried to call attention to this before but there isn't an active effort to crawl these. Once you download, normalize and deduplicate the entire corpus of password databases, you can find matches in real time for e.g. signup requests.
- Dolores12 8y agoIt would also be cool to implement native email reader inside firefox and some kind of messenger.
- auslander 8y agoTo Mozilla devs, if I may. Try OpenBSD approach to security, like in https://www.openbsd.org/security.html https://www.openbsd.org/security.html
- nehasen15 8y agoThis is a good news and good to know that Mozilla is improving. Though, WebEagle - https://webeagle.com/ https://webeagle.com/ has already been helping web users by exposing data breaches for a very long time. WebEagle is an integrated web technology that monitors all forms of hacking activities, dark web, underground forums of hackers and hackers' database, to notify the web users in time, if and when their accounts are hacked or their data is leaked. Uers can even buy WebEagle's securty services basis their individual requirements, wherein, WebEagle deligently scans every activity that happens around your accounts. Best, Neha, Communication Manager at WebEagle
- auganov 8y agoIt's interesting how HIBP considers mainstream dating sites sensitive on par with adult sites, while shady hacking related forums are fair game.
- zrobotics 8y agoHave you considered the amount of PII the dating site is likely to have on their average customer? Access to a dating profile is almost as good as Facebook access to perpetrate identity theft.
- detaro 8y agoThat's not what makes a breach "sensitive" for HIBP, it's about breaches that only can be checked if you authenticated your e-mail address or domain, so that not everyone can check if you've used the site.
- strken 8y agoI always assumed this was to avoid outing people as gay, to avoid kids working out that their mother started dating again, or to avoid an Ashley Madison-type scenario. Those seem more dangerous than being found to have an account on dodgy-carderz.com.
- YvetteBrooks 8y ago"Have I been pwned" is just a more friendly than "Was my password easy?". But the truth should be known!
- detaro 8y agoNot only, since bad passwords aren't the only way passwords can leak, bad password storage practices on a hacked site do it too. HIBP also includes leaks that didn't include recoverable passwords, but other personal data.
- YvetteBrooks 8y agoWell, truth. If the password were ejected from let's say "the random" website and you use the same one for all other ones you are kinda "pwned".
- auslander 8y ago> Have I Been Pwned You are. HN sits behind Cloudflare. Your SSL connection terminates at Cloudflare to plaintext, and new SSL connection to HN is created. Your login and password, IP and User-Agent and who knows what else, is in clear view to Cloudflare - you've been pwned :))
- mar77i 8y agoThat's such an amazing thing about them. I know a few places that... would pretty much die for such a global "MITM" service, so I wonder if it's five corners financing it.
- auslander 8y agoI need a browser extension (for Safari) to warn me if the site is behind Cloudflare. I'll pay money :) I'm kinda protected by using VPN, IP is not my ISP IP. But the rest, plus browser fingerprinting is busted. Use this: www.cloudflare.com/ips/ and HTTP headers like CF-RAY
- tomschlick 8y agoYou could also just use the ASN of the network which is always cloudflare for CF ips.
- auslander 8y agoYou're on, hired. Presentation with demo is at 4 July 10:00am GMT. Congrats :))
- ReverseCold 8y agoThat's not easy to retrieve from a browser extension without using an external service, right?
- detaro 8y agosame as with any other CDN, the load-balancer frontend of any cloud provider (e.g. if HIBP weren't behind Cloudflare, would you post the same about Azure, where its backend lives?), ... I get why people are critical of SSL termination that talks to the backend over public channels unencrypted (which Cloudflare offers too), but for the HTTPS-to-HTTPS case they behave exactly like many other companies.
- poorman 8y agoTroy has done great security work for the community at large. If you haven't seen it check out one of his other projects https://report-uri.com https://report-uri.com that aggregates your Content Security Policy reports for your site; a base security measure almost everyone should be utilizing for their sites these days.
- nabla9 8y ago"Have I been Pawned" should require email verification. The way it's now, you can do searches for people's emails and get info of the sites people have been using.
- mrunkel 8y agoYou realize they are only using data that is already publicly available right?