10 ms·
Introducing Firefox Monitor, Helping People Take Control After a Data Breach
- kgwxd 8y agoI like that subscription is email verification only, I didn't have to create a "Mozilla Account" with a password or anything like that. If Google or MS offered this, I'm sure you'd need an account that would also sign you into their entire ecosystem.
- ndnxhs 8y agoIts amazing how nice things are to use when they aren't trying to sell your data
- profalseidol 8y agoThe world would be a lot nicer when profit is not the goal
- profalseidol 8y agoAnd we would have probably reached Alpha Centauri by now.
- lmcarreiro 8y agoIt seems that it is just an UI over the haveibeenpwned.com service
- iscrewyou 8y agoYou are correct. They discuss here how it works: https://blog.mozilla.org/security/2018/06/25/scanning-breached-accounts-k-anonymity/ https://blog.mozilla.org/security/2018/06/25/scanning-breach...
- romanovcode 8y agoSo how is it different then?
- groovecoder 8y agoNo difference on the site/service side (yet). Stay tuned for more, though! ;)
- newscracker 8y agoThis is a good development. Since this is integrated with haveibeenpwned, I'd expect the next step to be integration with Firefox Lockbox [1] and Firefox Sync (with password sync selected). That would be quite helpful – a free password storage/sync app/service that can also monitor and alert users on Lockbox/Firefox (as opposed to having to sign up on Firefox Monitor with every email address that one uses). This is what 1Password did a few months ago, integrating with haveibeenpwned to alert users. Right now Firefox Lockbox is not available everywhere and is not out on Android yet. That also would need to change fast for this to be adopted widely. [1]: https://lockbox.firefox.com/ https://lockbox.firefox.com/
- chrisweekly 8y agoty for such an informed and helpful comment
- techntoke 8y agoMozilla has very poor justification as to why. It's not like they have a light-weight cross-platform UI framework to build their applications with, much like their web browser should be.
- pjc50 8y ago... what happened to XUL?
- franga2000 8y agoXUL and Mozilla are like DOS and Microsoft. It's old and broken, but no matter how much they try to get rid of it, some bit of it always survives.
- dralley 8y agoPoorly documented, implementation-defined, fragile, in-house only, etc. Mozilla can't hire anyone with deep knowledge of XUL to maintain XUL, and they can't assume the current generation of experts will be around forever. They're trying to get rid of it. Writing more of it as anything but a stopgap would be counter to their current goals.
- whyever 8y agoIs this more than a reskinning of Have I Been Pwned?
- kibwen 8y agoIt's basically an effective way to get HIBP out in front of more people. The announcement from Troy Hunt's side: https://www.troyhunt.com/were-baking-have-i-been-pwned-into-firefox-and-1password/ https://www.troyhunt.com/were-baking-have-i-been-pwned-into-... : "This is major because Firefox has an install base of hundreds of millions of people which significantly expands the audience that can be reached once this feature rolls out to the mainstream. [...] I'm really happy to see Firefox integrating with HIBP in this fashion, not just to get it in front of as many people as possible, but because I have a great deal of respect for their contributions to the technology community. [...] They've also been instrumental in helping define the model which HIBP uses to feed them data without Mozilla disclosing the email addresses being searched for."
- AdmiralAsshat 8y agoWhat protects the database of people who have signed up for e-mail notifications when their given e-mail has been involved in a breach? (Put another way, "What stops this database of breaches from becoming another entry in the database of breaches?")
- SentientNo4 8y agoIn that case, all that is leaked is your email address, which is probably in every email database already. Email addresses are not terribly easy to keep secret anyway.
- Mediterraneo10 8y agoAm I the only person worried about how this represent a potential violation of privacy? You can not only enter your e-mail address to see how you are affected, you could also put in the e-mail addresses of other people, and boom, you can see what communities they have signed up for, assuming those sites have suffered a breach some time in the past. I might have given Last.fm my e-mail address during the signup process, for example, but I might not necessarily want the whole world to be able to determine that I have signed up for Last.fm. Yes, I am aware that the breached data is already floating around on the internet, but it isn’t so convenient to consult it as on this website (or Have I Been Pwned?). These sites ought to require that a person prove they own that e-mail address before returning data concerning it.
- politelemon 8y agoThis was addressed in a blog post after Ashley Madison incident: https://www.troyhunt.com/have-i-been-pwned-opting-out-vtech-and/ https://www.troyhunt.com/have-i-been-pwned-opting-out-vtech-...
- move-on-by 8y agoBy addressing it, there is an opt-out of having your email address publicly searchable https://haveibeenpwned.com/OptOut https://haveibeenpwned.com/OptOut
- TheRealPomax 8y agoIn response to your first paragraph: "...yes?" You're literally describing the ramifications of a data breach. Whether the data is easy to get is entirely irrelevant: once it IS available, you'll have to operate under the assumption that any damage that can be done, will be done. As for the second paragraph, it is trivial to grab a copy of all this data. The only ones that are hard to get are the ones you (or even anyone) haven't been told about yet.
- ndnxhs 8y agoThe database leaks are usually very easy to obtain. You can just run grep over them and find anyone's account
- e1ven 8y agoI'm curious why they're applying the "Firefox" branding to this. I suppose it makes sense as a Mozilla project, but what does it have to do with the browser?
- varenc 8y agoThey want to boost the Firefox brand and demonstrate to users how much Firefox cares about security. The browser is also the main way users interact with the web, so associating this web security project with Mozilla's browser's brand seems fine to me.
- dblohm7 8y agoMarket research has shown that "Firefox" has much better brand recognition than "Mozilla."
- techntoke 8y agoRemember that time Mozilla CEO donated to Prop 8?
- dang 8y agoThis breaks the site guidelines, which ask you not to introduce flamebait into threads. It leads to flamewars, and we don't want those here. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- techntoke 8y agoSo funny that you had no interest in enforcing this rule in regards to the posts about Chrome/Chromium yesterday. Also, the topic is relevant to the comment/topic and organization being discussed. Why ignore it when your Mozilla sponsors can say whatever about Google and Chrome, even if they are obvious lies? At least what I said is documented and true.
- 8y ago
- billysielu 8y agoNo good if you use catchall to give every site a different email address?
- paulintrognon 8y agoFYI, http://monitor.firefox.com/ http://monitor.firefox.com/ does not seem to work. https://monitor.firefox.com/ https://monitor.firefox.com/ does work.
- sciurus 8y agoYou should be getting a 301 redirect from the former to the latter.
- paulintrognon 8y agoThey have since changed the links in the article
- augbog 8y agoI get a 429 response sometimes?
- groovecoder 8y agoWe have wrapped the /scan endpoint in rate-limiting to mitigate and alert on abusive scanning. We are fine-tuning the rate limit as we see more real user traffic coming in.
- Hasknewbie 8y agoThis is a good thing, but frankly I would rather Mozilla fix their own stuff first, like that password manager that is synchronized across instances but unlocked by default... You have to remember to set a (new and local) master-password after each install. Not optimal.
- TheRealPomax 8y agoWhy would you think this project, and the things you're talking about, are the work of the same teams in a 1000 employee company? It's far more likely that there's twenty different things all moving at the same time, and this happened to be just one of them.
- onedognight 8y agoI have many email addresses, so this service is useless to me. However, it seems like Firefox could integrate this into the browser itself to check all email/password combinations protected by its master password. Slightly related, why the doesn’t Firefox offer to generate strong passwords like Safari does?
- davidy123 8y agoI have a similar issue. I use 'keyed' email addresses, in my case the domain is contained in the address (myname_domain@mydomain.com). This is an included feature in many mailers, even google supports it youraddress+key@gmail.com. Anyway, it won't work unless Firefox Monitor supports wildcards.
- snowwolf 8y agoI posted the same elsewhere in this thread, but if you are actually using a domain you control (@mydomain.com) then https://haveibeenpwned.com/domainsearch https://haveibeenpwned.com/domainsearch They don't support the gmail alias issue though (https://haveibeenpwned.uservoice.com/forums/275398-general/suggestions/6774229-enable-search-and-notifications-for-email-addresse https://haveibeenpwned.uservoice.com/forums/275398-general/s...)
- davidy123 8y agoThank you!
- nirelCALBO 8y agojews are behind this beware
- _6413 8y agoYour isValidEmail() function is incorrectly and redundantly implemented. function isValidEmail(e) { const b = /^(([^<>()[\]\\.,;:\s@"]+(\.[^<>()[\]\\.,;:\s@"]+)*)|(".+"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$/; return b.test((e + "").toLowerCase()) } 1. The valid email address n@ai (which used to be the real maintained email address of Ian Goldberg) doesn't pass this function. People can put DNS records on TLDs. 2. You're calling toLowerCase() yet the regex is already case-agnostic. If you're going to attempt email address validation, either go all out[1], or just use isValidEmail=(e)=>~e.indexOf("@") [1]: http://www.ex-parrot.com/~pdw/Mail-RFC822-Address.html http://www.ex-parrot.com/~pdw/Mail-RFC822-Address.html
- Faaak 8y agoYou're being pedantic, but you're right. Either do it right, or don't do it at all
- flukus 8y agoThis is the only reply by someone with the right attitude, your the sort of person I'd like to work with and would want building the software I use. I'm just shaking my head at the rest of them, proud of mediocrity.
- DanBlake 8y agoI disagree. While n@ai might be a technically valid email, its such a extreme edge case ( maybe 1 out of 1,000,000 people have a email like this) that its worth denying that person registration to keep the likely thousands of erroneous emails from being entered incorrectly and the time that goes into correcting them. Same thing goes for addresses like "<>;@\'`{}|.a"@παράδειγμα.δοκιμή Honestly, if you decide to use a email like n@ai you already know what to expect. Most services wont let you sign up, And even if they do most will likely incur errors in the application when you attempt to do things. In reality, while it may be 'in spec' to use such a email, we can all hope that edge cases that allow it are changed and the legacy 'rules' that allowed it in the first place phased out completely. So, in practice in the 'real world'- n@ai is not a valid email address and never will be. If I create a web application you can bet your bottom dollar I wont allow it and I will create less work for myself by doing so.
- hadrien01 8y agoSuch a shame the website isn't available in multiple languages. It seems it would be easy enough to understand for non-technical people, but in English only.
- groovecoder 8y agoStay tuned! Localization is our next highest-priority enhancement.
- heroprotagonist 8y agoWhile interesting, Firefox Monitor is itself leaking data about my online activities by providing this scan service. Anyone with my email address can get access to various hobbies and even potentially learn where to find more information (and what kind). While they are not primary leaker, Firefox Monitor providing the information this way is disheartening. Most people in my network do not know about Have I Been Pwned (the source of the scan data), but they _do_ know about Firefox. This brand recognition and resulting media impact will spread my bits of personal information wider and into my direct network of contacts. I'd much prefer a qualification requirement. Make me click a link in an email you send when I ask for information about an email address instead of providing unfettered access to a list of (breached) services the email was used for over the past decade. I expect better from Mozilla/FF.
- prepend 8y agoI look at this differently. Your leaked data are in the public domain. Efforts are made to reduce risk, but the issue of "leaking" info is a bit nickpicky as the data isn't a risk and your hobbies are already out in the open.
- bfred_it 8y agoPublic domain doesn’t mean easily accessible. Even if I’m able to find an organize this data from torrents and online pastes, I wouldn’t use it unless the effort was worth it. With tools like this your grandma will find out where you’re registered to. An easy fix would be to deliver the results to my email.
- groovecoder 8y agoThanks for taking the time to provide feedback. As mentioned in another comment, you can opt-out of the HIBP database here: https://haveibeenpwned.com/OptOut https://haveibeenpwned.com/OptOut I also filed https://github.com/mozilla/blurts-server/issues/466 https://github.com/mozilla/blurts-server/issues/466 to consider making this visible in the Monitor UI.
- 8y ago
- deleted 8y ago[deleted]
- userbinator 8y agoIMHO the choice of name is unfortunate --- "Firefox Monitor" just sounds more like another invasive telemetry thing than anything else, and the word "monitor" itself (outside the context of the computer display) carries surveillance connotations. "Firefox Leakchecker" or similar would be clearer.
- eklavyaa 8y agothe only reason I will try it because its from Mozilla, an org I have been following from many years otherwise I dont beleive in have I pawned or sth. It looks very fishy providing your email ID, ok if I am not pawned but I ended up providing my email id, which might be sold further :|
- jesuisuncaillou 8y agoBut. What if Firefox Monitor had a data breach ? Just trolling here, don't pay attention.
- tumetab1 8y agoWould be great if they could workaround haveibeenpwned lack of support to gmail alias. I understand Troy assessment on the issue but would be great nonetheless.
- fogetti 8y agoInterestingly the monitor and HIBP give different results (the monitor excludes unverified breaches).