5 ms·

Mozilla has wasted a bunch of resources creating a pointless tool. Let me explain why! Last year, they promised to create an add-on that triggered when you vis

by ccnafr 8y ago

Mozilla has wasted a bunch of resources creating a pointless tool. Let me explain why! Last year, they promised to create an add-on that triggered when you visited sites known to have been breached in the past, and let the user check if his password was included in the leaked data, via HIBP: https://www.bleepingcomputer.com/news/security/firefox-will-warn-users-when-visiting-sites-that-suffered-a-data-breach/ https://www.bleepingcomputer.com/news/security/firefox-will-... Now, they announced Firefox Monitor, which is nothing but a standalone website where you can check your email and see if it's been included in public breaches. This is the same functionality of the main HIBP website. If people want to check if their email was included in a breach, they'd just visit HIBP, not Firefox Monitor. Why does this website exist in the first place? They took a good idea that used a proactive approach to alerting users of potentially leaked passwords and they've created a Firefox-branded HIBP clone website that very few people are gonna know about or even use. Pointless use of resources, when they could have used them for something actually useless.

qaz_plm 8y ago
>> ...that very few people are gonna know about or even use "This is major because Firefox has an install base of hundreds of millions of people which significantly expands the audience that can be reached once this feature rolls out to the mainstream." https://www.troyhunt.com/were-baking-have-i-been-pwned-into-firefox-and-1password/#mozillaandfirefoxmonitor https://www.troyhunt.com/were-baking-have-i-been-pwned-into-...
kadenshep 8y ago
You're ignoring how most users need things in front of their face. Most users are not privacy or security "aware" in any manner. Putting it in the UI or actively promoting these services is beneficial to the common web user. And if it fails, it's at least worth it to learn why it failed. Was the UI bad? Did it not promote the service in the right way? Did users not understand the purpose of the tool? I think the juice is worth the squeeze.
- tomc1985 8y ago
  And then everyone suffers through even more intrusions on their workflow because Johnny Newbie doesn't care
- ccnafr 8y ago
  Where in the official announcement did they say they're putting Monitor in the official UI? Firefox Monitor is just a page on the official Mozilla website.
  - seba_dos1 8y ago
    Where in the official announcement did they say that?
    - Arnavion 8y ago
      >Visitors to the Firefox Monitor website >The site will offer recommendations Now, the screenshot doesn't have a URL in the address bar, suggesting it might be a built-in special page. But it also has a generic "Page title" in the tab title, so it looks like a modified stock image rather than an actual UI screenshot. The screenshot on Troy Hunt's blog does show "https://www.mozilla.org/firefoxmonitor" https://www.mozilla.org/firefoxmonitor", but it's otherwise the same screenshot with the same generic "Page title", so it's probably equally fake. (I tried to look for the actual bugzilla bug for this for more info, but didn't find anything.)
      - sciurus 8y ago
        https://bugzilla.mozilla.org/show_bug.cgi?id=1463301 https://bugzilla.mozilla.org/show_bug.cgi?id=1463301 describes the study that is being run to determine the best design for incorporating Firefox Monitor into the browser UI. (Disclosure: Although I work at Mozilla, I have not worked on Firefox Monitor)
        Arnavion 8y ago
        Thanks. So it looks like it is a website ( https://monitor.firefox.com/ https://monitor.firefox.com/ ), and the browser will pop up a dialog that navigates users to it.
remir 8y ago
The intentions are good, but yeah, it seems like an half-baked solution. Why not integrate this tool directly into the browser UI? User goes to whatever website, input his login creds, Firefox reads the login email and sees if the email+url combo is in the HIBP database. If yes, a message will advise the user to change his password. End of story.
aroberge 8y ago
So, you conclude that it is a pointless tool because people can consult the HIPB website directly. Meanwhile, Troy Hunt, the creator of the HIPB website himself writes that this is a good idea.
- untangle 8y ago
  Well, with respect, this is an undeniable win for Troy. I think that the parent comment was questioning how big a win it is for The Rest of Us.

by ccnafr 8y ago

qaz_plm 8y ago

>> ...that very few people are gonna know about or even use "This is major because Firefox has an install base of hundreds of millions of people which significantly expands the audience that can be reached once this feature rolls out to the mainstream." https://www.troyhunt.com/were-baking-have-i-been-pwned-into-firefox-and-1password/#mozillaandfirefoxmonitor https://www.troyhunt.com/were-baking-have-i-been-pwned-into-...

kadenshep 8y ago

You're ignoring how most users need things in front of their face. Most users are not privacy or security "aware" in any manner. Putting it in the UI or actively promoting these services is beneficial to the common web user. And if it fails, it's at least worth it to learn why it failed. Was the UI bad? Did it not promote the service in the right way? Did users not understand the purpose of the tool? I think the juice is worth the squeeze.

tomc1985 8y ago
And then everyone suffers through even more intrusions on their workflow because Johnny Newbie doesn't care
ccnafr 8y ago
Where in the official announcement did they say they're putting Monitor in the official UI? Firefox Monitor is just a page on the official Mozilla website.
- seba_dos1 8y ago
  Where in the official announcement did they say that?
  - Arnavion 8y ago
    >Visitors to the Firefox Monitor website >The site will offer recommendations Now, the screenshot doesn't have a URL in the address bar, suggesting it might be a built-in special page. But it also has a generic "Page title" in the tab title, so it looks like a modified stock image rather than an actual UI screenshot. The screenshot on Troy Hunt's blog does show "https://www.mozilla.org/firefoxmonitor" https://www.mozilla.org/firefoxmonitor", but it's otherwise the same screenshot with the same generic "Page title", so it's probably equally fake. (I tried to look for the actual bugzilla bug for this for more info, but didn't find anything.)
    - sciurus 8y ago
      https://bugzilla.mozilla.org/show_bug.cgi?id=1463301 https://bugzilla.mozilla.org/show_bug.cgi?id=1463301 describes the study that is being run to determine the best design for incorporating Firefox Monitor into the browser UI. (Disclosure: Although I work at Mozilla, I have not worked on Firefox Monitor)
      - Arnavion 8y ago
        Thanks. So it looks like it is a website ( https://monitor.firefox.com/ https://monitor.firefox.com/ ), and the browser will pop up a dialog that navigates users to it.

remir 8y ago

The intentions are good, but yeah, it seems like an half-baked solution. Why not integrate this tool directly into the browser UI? User goes to whatever website, input his login creds, Firefox reads the login email and sees if the email+url combo is in the HIBP database. If yes, a message will advise the user to change his password. End of story.

aroberge 8y ago

So, you conclude that it is a pointless tool because people can consult the HIPB website directly. Meanwhile, Troy Hunt, the creator of the HIPB website himself writes that this is a good idea.

untangle 8y ago
Well, with respect, this is an undeniable win for Troy. I think that the parent comment was questioning how big a win it is for The Rest of Us.