4 ms·

I'd love to see a non-profit organisation like Mozilla pick this up, but that's obviously going to mean a lot less money going to Troy. OTOH, it's kind of diff

I'd love to see a non-profit organisation like Mozilla pick this up, but that's obviously going to mean a lot less money going to Troy. OTOH, it's kind of difficult to begrudge Troy gaining financially from HIBP, since he's spent years building it up and has helped increase security awareness for so many people.

cknight 7y ago
Given Mozilla's current direction in terms of looking for more revenue streams, it might be quite well timed - if it can be commercialized successfully on the B2B end, that is. https://www.translatetheweb.com/?from=&to=en&a=https://t3n.de/news/mozilla-ceo-chris-beard-anbieten-1168614/3/ https://www.translatetheweb.com/?from=&to=en&a=https://t3n.d...
- tomglynch 7y ago
  Mozilla also recently launched their own version of HIBP that just gets the data from HIBP and passes it to their users: https://monitor.firefox.com/ https://monitor.firefox.com/ Though just realised, they're not that upfront about giving HIBP credit - If I were Troy this would peeve me a bit.
  - lol768 7y ago
    It's not massively advertised on the homepage (though in some respects, I think outside of infosec circles "Firefox Monitor" probably sounds more professional/neutral than "Have I been pwned"). I think they discussed HIBP in the launch announcement: https://blog.mozilla.org/security/2018/11/14/when-does-firefox-alert-for-breached-sites/ https://blog.mozilla.org/security/2018/11/14/when-does-firef... It's also in the FAQ: https://support.mozilla.org/en-US/kb/firefox-monitor-faq https://support.mozilla.org/en-US/kb/firefox-monitor-faq
  - luag 7y ago
    Just tried it, they specifically write "Breach data provided by Have I Been Pwned" at the end of results.
  - flurdy 7y ago
    I thought the same when I initially was prompted about Firefox monitor at the bottom of Firefox's new tab page. Was a little peeved at what seemed like a copy, but I have now realised it is just building on top of Troy's work [1] which is even better because of Firefox's larger reach. They don't have to have a blinking marque text at the top attributing it to Have I Been Pwned. But they could have mentioned it on the front page somewhere that HIBP is one of their main sources. I trust HIBP, therefore, more value to Firefox Monitor had I known that link. [1] https://www.troyhunt.com/were-baking-have-i-been-pwned-into-firefox-and-1password/ https://www.troyhunt.com/were-baking-have-i-been-pwned-into-...
    - Vinnl 7y ago
      > I trust HIBP, therefore, more value to Firefox Monitor had I known that link. If you trust HiBP, you don't really need Firefox Monitor. It was created specifically to reach people that HiBP could not reach.
peterburkimsher 7y ago
I feel like Mozilla is well-positioned to meet Troy's requirements. It won't be cheap for them, but I think their branding is much more in line with his goals than the large FAANG tech companies. It makes sense to tie it into the Firefox Account password manager too. Mozilla could leverage Troy's close connections with industry to have Firefox as the recommended secure & open-source option for enterprise clients. Something that hasn't been touched on as much is the limitations that come with contracts for large commercial companies. Side projects are often expressly forbidden. Yes, Google with give you 20% time to work on your own ideas, but you can't then upload it to your personal website and call it your own - it becomes company property and may never see the light of day. I imagine that Mozilla are more open-minded in that respect. They also have plenty of experience with remote teams, which would work well for his family/travel tradeoffs. Please, Mozilla - if this opportunity is offered to you, take it.
- pbhjpbhj 7y ago
  No, this shouldn't be used to segregate browsers. You just end up cutting a tonne of people of from the benefit unless the subscribe to the "we're sending all your DNS calls to third-parties and installing plugins you can't remove to advertise stuff you don't want"-browser.
- tomglynch 7y ago
  Troy works with Microsoft currently, so I doubt it would work with Mozilla as MS have Edge
  - nandipmakwana 7y ago
    Microsoft Regional Director don't work for Microsoft. If that's what you are referring to. They are recognized by Microsoft based on one's expertise & skills.
    - tomglynch 7y ago
      Ah yes, my mistake.
pbhjpbhj 7y ago
HIBP only works because of trust in Troy Hunt, few organisations have that. Maybe an organisation not involved in advertising at any level.
- GordonS 7y ago
  It's definitely trust in Troy, and the level of transparency he's maintained, that have led to HIBP being successful. But I, personally, would now trust Mozilla with this, were there to take ownership.
  - OskarS 7y ago
    I was just thinking, the only ones I can imagine taking ownership would be one of the "big internet foundations" that have earned their trust: Mozilla, the Internet Archive, Wikimedia, or the EFF. Of those, Mozilla and the EFF are the only ones that make real sense. I hope it's one of them, and not fucking Norton AntiVirus or whatever.
    - GordonS 7y ago
      I agree about EFF - I'd be happy with Mozilla or EFF.
- duxup 7y ago
  Could they leverage some sort of Troy partnership / oversight? "Troy Approved!" Mozilla is a good group, they've had missteps but I find them trustworthy and the combination would be pretty trustworthy IMO.
  - ygjb 7y ago
    A Mozilla acquisition of HIBP could look alot like Mozilla buying HIBP from them, and then bringing Troy on board for a period of time as an evangelist, and the nature of being an open source, community focused org means that Troy could retain his ties to Mozilla as long as he wants to, as a staff member or volunteer. I don't know how much has changed since I left Mozilla, but there were, and probably still are, a number of former employees and volunteer contributors that had a great degree of influence and input on various projects. Heck, Troy might even be a good potential addition to the Mozilla board of directors at some point in the future.
WorldMaker 7y ago
I also think that HIBP is something of a "public good" and would be best for some sort of non-profit or another. Mozilla is possibly the best currently aligned, of course. Another weird thought is that it's the sort of "baseline infrastructure" that should be "governmental" to the internet. Unfortunately the closest I can think to an existing model for that is ICANN and that may not be something to emulate.

cknight 7y ago

Given Mozilla's current direction in terms of looking for more revenue streams, it might be quite well timed - if it can be commercialized successfully on the B2B end, that is. https://www.translatetheweb.com/?from=&to=en&a=https://t3n.de/news/mozilla-ceo-chris-beard-anbieten-1168614/3/ https://www.translatetheweb.com/?from=&to=en&a=https://t3n.d...

tomglynch 7y ago
Mozilla also recently launched their own version of HIBP that just gets the data from HIBP and passes it to their users: https://monitor.firefox.com/ https://monitor.firefox.com/ Though just realised, they're not that upfront about giving HIBP credit - If I were Troy this would peeve me a bit.
- lol768 7y ago
  It's not massively advertised on the homepage (though in some respects, I think outside of infosec circles "Firefox Monitor" probably sounds more professional/neutral than "Have I been pwned"). I think they discussed HIBP in the launch announcement: https://blog.mozilla.org/security/2018/11/14/when-does-firefox-alert-for-breached-sites/ https://blog.mozilla.org/security/2018/11/14/when-does-firef... It's also in the FAQ: https://support.mozilla.org/en-US/kb/firefox-monitor-faq https://support.mozilla.org/en-US/kb/firefox-monitor-faq
- luag 7y ago
  Just tried it, they specifically write "Breach data provided by Have I Been Pwned" at the end of results.
- flurdy 7y ago
  I thought the same when I initially was prompted about Firefox monitor at the bottom of Firefox's new tab page. Was a little peeved at what seemed like a copy, but I have now realised it is just building on top of Troy's work [1] which is even better because of Firefox's larger reach. They don't have to have a blinking marque text at the top attributing it to Have I Been Pwned. But they could have mentioned it on the front page somewhere that HIBP is one of their main sources. I trust HIBP, therefore, more value to Firefox Monitor had I known that link. [1] https://www.troyhunt.com/were-baking-have-i-been-pwned-into-firefox-and-1password/ https://www.troyhunt.com/were-baking-have-i-been-pwned-into-...
  - Vinnl 7y ago
    > I trust HIBP, therefore, more value to Firefox Monitor had I known that link. If you trust HiBP, you don't really need Firefox Monitor. It was created specifically to reach people that HiBP could not reach.

peterburkimsher 7y ago

I feel like Mozilla is well-positioned to meet Troy's requirements. It won't be cheap for them, but I think their branding is much more in line with his goals than the large FAANG tech companies. It makes sense to tie it into the Firefox Account password manager too. Mozilla could leverage Troy's close connections with industry to have Firefox as the recommended secure & open-source option for enterprise clients. Something that hasn't been touched on as much is the limitations that come with contracts for large commercial companies. Side projects are often expressly forbidden. Yes, Google with give you 20% time to work on your own ideas, but you can't then upload it to your personal website and call it your own - it becomes company property and may never see the light of day. I imagine that Mozilla are more open-minded in that respect. They also have plenty of experience with remote teams, which would work well for his family/travel tradeoffs. Please, Mozilla - if this opportunity is offered to you, take it.

pbhjpbhj 7y ago
No, this shouldn't be used to segregate browsers. You just end up cutting a tonne of people of from the benefit unless the subscribe to the "we're sending all your DNS calls to third-parties and installing plugins you can't remove to advertise stuff you don't want"-browser.
tomglynch 7y ago
Troy works with Microsoft currently, so I doubt it would work with Mozilla as MS have Edge
- nandipmakwana 7y ago
  Microsoft Regional Director don't work for Microsoft. If that's what you are referring to. They are recognized by Microsoft based on one's expertise & skills.
  - tomglynch 7y ago
    Ah yes, my mistake.

pbhjpbhj 7y ago

HIBP only works because of trust in Troy Hunt, few organisations have that. Maybe an organisation not involved in advertising at any level.

GordonS 7y ago
It's definitely trust in Troy, and the level of transparency he's maintained, that have led to HIBP being successful. But I, personally, would now trust Mozilla with this, were there to take ownership.
- OskarS 7y ago
  I was just thinking, the only ones I can imagine taking ownership would be one of the "big internet foundations" that have earned their trust: Mozilla, the Internet Archive, Wikimedia, or the EFF. Of those, Mozilla and the EFF are the only ones that make real sense. I hope it's one of them, and not fucking Norton AntiVirus or whatever.
  - GordonS 7y ago
    I agree about EFF - I'd be happy with Mozilla or EFF.
duxup 7y ago
Could they leverage some sort of Troy partnership / oversight? "Troy Approved!" Mozilla is a good group, they've had missteps but I find them trustworthy and the combination would be pretty trustworthy IMO.
- ygjb 7y ago
  A Mozilla acquisition of HIBP could look alot like Mozilla buying HIBP from them, and then bringing Troy on board for a period of time as an evangelist, and the nature of being an open source, community focused org means that Troy could retain his ties to Mozilla as long as he wants to, as a staff member or volunteer. I don't know how much has changed since I left Mozilla, but there were, and probably still are, a number of former employees and volunteer contributors that had a great degree of influence and input on various projects. Heck, Troy might even be a good potential addition to the Mozilla board of directors at some point in the future.

WorldMaker 7y ago

I also think that HIBP is something of a "public good" and would be best for some sort of non-profit or another. Mozilla is possibly the best currently aligned, of course. Another weird thought is that it's the sort of "baseline infrastructure" that should be "governmental" to the internet. Unfortunately the closest I can think to an existing model for that is ICANN and that may not be something to emulate.