4 ms·

While interesting, Firefox Monitor is itself leaking data about my online activities by providing this scan service. Anyone with my email address can get acces

While interesting, Firefox Monitor is itself leaking data about my online activities by providing this scan service. Anyone with my email address can get access to various hobbies and even potentially learn where to find more information (and what kind). While they are not primary leaker, Firefox Monitor providing the information this way is disheartening. Most people in my network do not know about Have I Been Pwned (the source of the scan data), but they _do_ know about Firefox. This brand recognition and resulting media impact will spread my bits of personal information wider and into my direct network of contacts. I'd much prefer a qualification requirement. Make me click a link in an email you send when I ask for information about an email address instead of providing unfettered access to a list of (breached) services the email was used for over the past decade. I expect better from Mozilla/FF.

prepend 8y ago
I look at this differently. Your leaked data are in the public domain. Efforts are made to reduce risk, but the issue of "leaking" info is a bit nickpicky as the data isn't a risk and your hobbies are already out in the open.
- bfred_it 8y ago
  Public domain doesn’t mean easily accessible. Even if I’m able to find an organize this data from torrents and online pastes, I wouldn’t use it unless the effort was worth it. With tools like this your grandma will find out where you’re registered to. An easy fix would be to deliver the results to my email.
groovecoder 8y ago
Thanks for taking the time to provide feedback. As mentioned in another comment, you can opt-out of the HIBP database here: https://haveibeenpwned.com/OptOut https://haveibeenpwned.com/OptOut I also filed https://github.com/mozilla/blurts-server/issues/466 https://github.com/mozilla/blurts-server/issues/466 to consider making this visible in the Monitor UI.
- gbrayut 8y ago
  I wasn't aware of the opt out. Thansk!
kibwen 8y ago
What this is effectively asking is that no non-technical person ought to have the ability to be made aware that their data has been stolen. As far as I'm concerned, the amount of actual good done by haveibeenpwned far outweighs these theoretical risks--especially so if it becomes popularized more among non-technical people, as is being done here, because it lessens the power asymmetry that technical people currently enjoy by dint of being able to find and process these already-public datasets.
someonenice 8y ago
They could send the results directly to the email id that was queried.

prepend 8y ago

I look at this differently. Your leaked data are in the public domain. Efforts are made to reduce risk, but the issue of "leaking" info is a bit nickpicky as the data isn't a risk and your hobbies are already out in the open.

bfred_it 8y ago
Public domain doesn’t mean easily accessible. Even if I’m able to find an organize this data from torrents and online pastes, I wouldn’t use it unless the effort was worth it. With tools like this your grandma will find out where you’re registered to. An easy fix would be to deliver the results to my email.

groovecoder 8y ago

Thanks for taking the time to provide feedback. As mentioned in another comment, you can opt-out of the HIBP database here: https://haveibeenpwned.com/OptOut https://haveibeenpwned.com/OptOut I also filed https://github.com/mozilla/blurts-server/issues/466 https://github.com/mozilla/blurts-server/issues/466 to consider making this visible in the Monitor UI.

gbrayut 8y ago
I wasn't aware of the opt out. Thansk!

kibwen 8y ago

What this is effectively asking is that no non-technical person ought to have the ability to be made aware that their data has been stolen. As far as I'm concerned, the amount of actual good done by haveibeenpwned far outweighs these theoretical risks--especially so if it becomes popularized more among non-technical people, as is being done here, because it lessens the power asymmetry that technical people currently enjoy by dint of being able to find and process these already-public datasets.

someonenice 8y ago

They could send the results directly to the email id that was queried.