11 ms·

Firefox to Warn When Saved Logins Are Found in Data Breaches

312 points by rahuldottech 7y ago

daveguy 7y ago
Firefox is using the wonderful haveibeenpwned resource. There is also a public API for haveibeenpwned if you want to incorporate it into your own clients: https://haveibeenpwned.com/API/v2 https://haveibeenpwned.com/API/v2 Please note rate limits/ abuse policy so everyone can use: https://haveibeenpwned.com/API/v2#RateLimiting https://haveibeenpwned.com/API/v2#RateLimiting (I am not affiliated)
- jakejarvis 7y ago
  1Password uses the HIBP API too [0] which has actually saved me a few times. The mechanics behind the v2 API (using k-anonymity with hashes [1]) are pretty interesting too. Troy has clearly put a lot of thought and time into what started as a pet project a few years ago and should be infinitely commended! [0] https://blog.1password.com/finding-pwned-passwords-with-1password/ https://blog.1password.com/finding-pwned-passwords-with-1pas... [1] https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/ https://www.troyhunt.com/ive-just-launched-pwned-passwords-v...
  - waynesonfire 7y ago
    I just read through 1Password release notes [0], "Addressed a bug in the new popup where items were checked for vulnerable passwords even if you hadn't opted in to the Have I Been Pwned service." which also links to a KB article that talks about the security risks of HIBP [1] I would be very concerned if my credentials are being shared in _any_ form with 3rd parties without my explicit permissions. I hope this firefox feature is disabled by default. [0] https://app-updates.agilebits.com/product_history/B5X https://app-updates.agilebits.com/product_history/B5X [1] https://support.1password.com/kb/201907/ https://support.1password.com/kb/201907/
    - groovecoder 7y ago
      Disclaimer: I'm the Firefox sec engineer working on this feature. Just to clear this up: The code for this is actually way simpler and sends no data to either Mozilla nor HIBP. To prevent Firefox from sending data update pings to HIBP, Firefox Monitor maintains a copy of publicly available HIBP breaches and their metadata [1] in the Firefox "Remote Settings" service. [2] Using that data, Firefox simply checks for saved logins for breached sites where the saved password is older than the breach. [3] [1] https://haveibeenpwned.com/api/v2/breaches https://haveibeenpwned.com/api/v2/breaches [2] https://wiki.mozilla.org/Firefox/RemoteSettings https://wiki.mozilla.org/Firefox/RemoteSettings [3] https://hg.mozilla.org/mozilla-central/file/6484c07ff83649914781ddc9cfb70e98466cdd7a/browser/components/aboutlogins/AboutLoginsParent.jsm#l377 https://hg.mozilla.org/mozilla-central/file/6484c07ff8364991...
      - MrStonedOne 7y ago
        This explanation confused me, so let me rewrite it: "Firefox downloads a list of breached domain names and the date they were breached, and merely checks if you have any stored logins on any breached domains that are older then the breach date."
    - MrStonedOne 7y ago
      Credentials are not shared under the hibp password system. the first five characters of the hex encoded md5 of the password is shared and the server responds with matching hashes. If 20 bits (2 and a half characters) of hashed entropy can compromise your password you have bigger problems.
- Deimorz 7y ago
  Probably worth noting that Have I Been Pwned is now up for sale: https://www.troyhunt.com/project-svalbard-the-future-of-have-i-been-pwned/ https://www.troyhunt.com/project-svalbard-the-future-of-have... I've always been a huge fan of the project (and Troy) and understand that it's gotten to a point where he can't keep running it as a spare-time project, but I'm still not very happy about seeing it being shopped around. I can't see how this type of service needing to find a way to become a business will be a good thing overall, especially when it keeps getting integrated into other programs and services like this. Troy pledges that nothing will change, but every company getting acquired does that, and then things change anyway. The best result would probably be something like Mozilla buying it and/or paying Troy to just keep doing what he's doing.
  - denzil_correa 7y ago
    > The best result would probably be something like Mozilla buying it and/or paying Troy to just keep doing what he's doing. Mozilla could very well be one of the potential candidates for HIBP ownership.
    - NeutronStar 7y ago
      Sure, but until then, nope.
    - bradknowles 7y ago
      Troy has spoken about that. They are a known candidate, but they fall further down the list on some of his criteria than he would like. However, he doesn't provide any further details on this issue. Meanwhile, he continues to look for other candidates.
  - Mirioron 7y ago
    I would even say that a project like this should be run by the government(s). I get that foreign politics would wreck havoc there, but governments have to deal with data breaches anyway.
    - 7y ago
- euroclydon 7y ago
  One thing HIBP does is match a password against a list of half a billion leaked passwords without regard for the username portion of the credentials. They do it because of the NIST guidance to compare credentials to known data leaks. The same NIST who's previous guidance was a complicated password entropy algorithm, which they later dropped. I've always questioned the logic making 500,000,000 passwords off limits when no connection is made to the username. Work-factor hashing algorithms, rate limiting account locking and 2FA are supposed to protect user from brute force attacks. I think they can handle an attack based on 500 million possibilities. Now, if they matched the username/password pair, that would be great.
  - tomschlick 7y ago
    The results show how often it was breached so you could always just blacklist passwords leaked more then 100 times or so. The really dangerous ones are the "common" one word passwords used hundreds of thousands of times.
    - deleted 7y ago
      [deleted]
  - bradknowles 7y ago
    The thing is that all of the passwords in his database, are ones that the blackhats already know. As in, they not only have the hashes, but the full in-the-clear passwords. His sources for these lists are blackhats themselves, who happen to leak their copies of their password lists, one way or the other. And all the major password cracking tools will typically try all the known bad passwords, before they try anything else. And they'll try all known likely variants, before making any potential brute-force attempts. So, it doesn't matter if the password you want to use is on this list and you want to use it anyway, just because it has never been associated with your userid. The simple fact that you're trying to use a known bad password that has ever been used before by anyone else, is enough to increase by many, many orders of magnitude the likelihood that someone will be able to crack your new favourite password. Bad passwords are simply bad, regardless of who tries to use them. Some are worse than others, but they're all bad. This aspect of HIBP helps you discover if any of your passwords have ever been cracked by anyone, and therefore now on the list of known bad passwords.
- cablej 7y ago
  There are fundamental privacy risks to using the HIBP Pwned Passwords service which should be considered when implementing it. See my writeup here — https://cablej.io/blog/k-anonymity/ https://cablej.io/blog/k-anonymity/. In short, despite claims of protecting privacy, a malicious server can recover user passwords in some cases even if they haven’t previously been compromised.
bovermyer 7y ago
Is Firefox trying to replicate all behavior of password managers?
- Groxx 7y ago
  Browsers that offer to save your passwords are password managers. They've just been downright abhorrent at it for years. Improving that seems worth doing?
  - woodrowbarlow 7y ago
    they certainly aren't as bad as they used to be, but the UX hasn't improved much. in-browser password managers these days have acceptable security and features like the one in the article are starting to surpass other password managers. but gawd, the UX. my biggest qualm with the UX of firefox's password manager is the "master password" feature. it's a password you must enter to unlock your keychain. that's a must-have for me. what firefox does wrong: * it's rendered as a simple dialog prompt, identical to javascript's window.prompt. could be faked by a site for phishing. * the unlock prompt launches once, about 30 seconds after the browser is launched (right while i'm in the middle of typing a URL) and grabs focus. * if you don't provide a password, the prompt will show up again each time you visit a page that has a login form for which you have a saved password, even if the login form is hidden with CSS. many sites have login forms on every page. * there's no way to unlock the keychain on a per-site basis or lock it again once you've unlocked it (besides closing the browser). what i want is: * when i'm about to log in to a site, i expect to provide my master password and have firefox autofill my saved password for this site only. * if i need the password again later, or a password for a different site, i expect to have to provide my master password again. * a dialogue that i can trust to have come from the browser itself rather than the webpage. * not to be interrupted by the dialogue unless i need to access a saved password.
    - Groxx 7y ago
      They seem to be working on the password manager in general lately(ish) e.g. https://lockwise.firefox.com/ https://lockwise.firefox.com/ , so I think there's a decent chance that side of things will improve. Because yeah, it has been an awful, nigh-unchanged experience for pretty much its whole existence.
qzw 7y ago
That’s a nice feature, and I hope other browsers will adopt something similar soon. Also looking forward to the password generator that’s finally coming in Firefox 69. On a slight tangent, I wish the major browsers would agree on an interoperability standard for their built-in password managers.
- mnoorenberghe 7y ago
  Press reports that this is shipping in Fx69 were incorrect.
  - qzw 7y ago
    No? That’s a bummer. What’s the correct EVA (estimated version of arrival)?
- r00fus 7y ago
  > On a slight tangent, I wish the major browsers would agree on an interoperability standard for their built-in password managers. Are you talking about an interop standard for storing/sharing passwords, or for generating them? Because the latter is hobbled significantly by a twisting maze of password requirements and login form implementations by sites (banks, webmail, etc).
  - vorpalhex 7y ago
    > an interop standard for storing/sharing passwords Is what we need. You can export from Chrome to a CSV, and you can import that CSV into 1Password, but no way to get those passwords into or out of Firefox that I've found (please tell me if you have a method..).
    - apetresc 7y ago
      > You can export from Chrome to a CSV, and you can import that CSV into 1Password, but no way to get those passwords into or out of Firefox that I've found (please tell me if you have a method..).* https://github.com/kspearrin/ff-password-exporter/blob/master/README.md#ff-password-exporter https://github.com/kspearrin/ff-password-exporter/blob/maste... :)
deleted 7y ago
[deleted]
java-man 7y ago
Does it mean your browser is going to leak your sites/account information to a third party? Will this feature be enabled by default? Can this be disabled?
- SketchySeaBeast 7y ago
  https://blog.mozilla.org/security/2018/06/25/scanning-breached-accounts-k-anonymity/ https://blog.mozilla.org/security/2018/06/25/scanning-breach...
  - java-man 7y ago
    thank you.
- snek 7y ago
  haveibeenpwned doesn't accept plain-text passwords for checking, they use a k-anonymity model to protect both your passwords and the passwords in the database. the same goes for email addresses. https://haveibeenpwned.com/API/v2#SearchingPwnedPasswordsByRange https://haveibeenpwned.com/API/v2#SearchingPwnedPasswordsByR...
- jsgo 7y ago
  HIBP doesn't work that way really. You don't query for a site breach + email combination, you basically give your email address and then it returns back a list of breaches your email address was part of. As far as HIBP linking your email to specific breaches, well, it is essentially using public data sets so that disclosure exists already (before HIBP even enters the picture). They are a bit more reserved with certain cases (the Ashley Madison breach for example), but even then if someone wanted to locate email addresses in that breach, they'd just go get that data set.
  - java-man 7y ago
    As long as this functionality can be disabled. This feature has a potential in connecting a browser (instance/session/ip) to an email (even in the form of abbreviated hash), which I would consider a security risk.
mwilliaams 7y ago
How does Firefox compare your actual password to the leaked password without storing your passwords in plaintext?
- feanaro 7y ago
  It is storing your passwords in plaintext locally, since this is about passwords that are saved by the user in Firefox's password store (the Saved Logins feature). These can (and should) be protected with a master password, but you obviously need to unlock the store before logging into a website. They're not storing your passwords remotely, though. They're asking haveibeenpwned which maintains a list of leaked login information from past breaches.
  - jxcl 7y ago
    It looks like they're not doing this, but it is also possible to see if your exact password is in the breach using an algorithm called k-anonymity: https://blog.cloudflare.com/validating-leaked-passwords-with-k-anonymity/ https://blog.cloudflare.com/validating-leaked-passwords-with...
    - lucideer 7y ago
      Mozilla are using k-anonymity in their FirefoxMonitor service[0]. This feature syncs from FirefoxMonitor to a local browser DB and checks against that DB. However, I'm not 100% sure what data it syncs from FirefoxMonitor (obviously a subset, but I don't know how that's chosen. I'm not sure if they're using k-anon for requests between the Firefox browser and their own service). [0] https://github.com/mozilla/blurts-server/blob/master/hibp.js#L59 https://github.com/mozilla/blurts-server/blob/master/hibp.js...
- want2know 7y ago
  I believe the article is false. As far as I understand [1] Firefox will notice you if the domain was breached and your password is older than the breach. [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1559365 https://bugzilla.mozilla.org/show_bug.cgi?id=1559365
AznHisoka 7y ago
OK, enough is enough. I'm switching to Firefox now. Protip to Firefox: Advertise this feature more. The other stuff I don't really care about, and didn't really convinced me to move to Firefox. Fear is an excellent motivator, however.
- numbers 7y ago
  You will be happy with the move, if you're coming from Chrome, most extensions/add-ons are available on Firefox so the transition was not tough for me. There are some things like getting used to the dev tools but that shouldn't be too bad :)
  - vorpalhex 7y ago
    I switched about two weeks ago. I had a few things I toggled in `about:config` but otherwise have been very happy. I appreciate how well Firefox works out of the box.
  - Mirioron 7y ago
    Can I use my own custom addons with Firefox? Or do I still need a developer/unstable version of Firefox for that?
    - yuchi 7y ago
      I don’t know the _real_ answer but in the worst case scenario (“you can’t”) you can for sure use temporary add-ons in about:debug
- mevile 7y ago
  Try and give Firefox Containers a test too. It's a Firefox extension made by Mozilla that creates separate environments where cookies and session data are not shared. It's a great feature I never want to do without. I use it to create a wall between work and personal web browsing.
  - Vinnl 7y ago
okasaki 7y ago
What data does this send and who receives it? Is money involved in this partnership? If so, who paid whom? What was the motivation behind this? Is there any study that shows any benefit from haveibeenpwned.com? I.e. has there been a decrease in hijacked accounts, etc?
- Vinnl 7y ago
  There's more about how Mozilla obtains the data here: https://www.troyhunt.com/were-baking-have-i-been-pwned-into-firefox-and-1password/#enablinganonymoussearcheswithkanonymity https://www.troyhunt.com/were-baking-have-i-been-pwned-into-... I don't think there's been studies, but it seems obvious to me that the goal here is to prevent re-use of leaked passwords, and I'd consider it a surprising result if this wouldn't help in that.
- Deimorz 7y ago
  CCP Games integrated it into Eve Online and says that it significantly reduced the number of players using insecure passwords: > When we first implemented the check, about 19% of logins were greeted with the message that their password was not safe enough. Today, this has dropped down to around 11-12% and hopefully will continue to go down. From https://www.eveonline.com/article/pu2gdi/account-security-improvements https://www.eveonline.com/article/pu2gdi/account-security-im...
- groovecoder 7y ago
  Answered here: https://news.ycombinator.com/item?id=20465981 https://news.ycombinator.com/item?id=20465981
Vinnl 7y ago
That sounds like a good reason to get your non-technical friends and relatives on Firefox. (Edit: though I wonder whether the really non-technical ones will not interpret this as having to change the displayed saved password, rather than having to visit the website.)
hartator 7y ago
How sending clear login and passwords to a third party website is ever a good idea?
- hughes 7y ago
  It isn't doing this. It uses rough hash of the password to generate a bucket ID that could represent a large number of passwords. That information is the used to query a bucket for whether any passwords in the bucket exist. For example, "password" hashes to "5DAA6", and the resulting bucket[1] lists secure hashes of several dozen passwords. The client then generates another hash of the password (eg. "1E4C9B93F3F0682250B6CF8331B7EE68FD8"), and checks if that secure hash is in the bucket (it is, "password" has been compromised at least 3,730,471 known times). [1]: https://api.pwnedpasswords.com/range/5BAA6 https://api.pwnedpasswords.com/range/5BAA6
  - MrStonedOne 7y ago
    This is also false. Why would it need to send the passwords? Could it not download a list of a every site that has ever been hacked along with their domain list and the date of the hacking, then warn you if you have a saved password for one of those domains that was saved before the domain was hacked? Because that's what it does.
- groovecoder 7y ago
  Answered here: https://news.ycombinator.com/item?id=20465981 https://news.ycombinator.com/item?id=20465981
dicks-in-ur-ass 7y ago
SAVING PASSWORDS IS FUCKING GAY. JUST REMEMBER YOUR FUCKING LOGIN.
Endy 7y ago
So you're saying that the browser client will now be regularly sending secure information on a regular basis to a predictable IP, across HTTP (hopefully S, but I'm sure there will be a fallback), via dynamic path and across an unknown number of hops for transit. And this is supposed to be more secure. I'm sure there's nothing to go wrong with that wonderful plan! Taking control away from the user is a great idea! Except that it's not.
- ekimekim 7y ago
  The haveibeenpwned API uses a k-anonymity model, so that the client can check a password in an efficient fashion (ie. without downloading the entire list of pwned hashes), without also revealing the hash you're trying to check. Basically, it asks for all pwned hashes that start with the same 5 characters as your password's (hex-encoded) hash. So yes, there is an information leak (the first 5 characters of your hash), but it's an extremely unimportant one. Even knowing the first 5 characters, there's still 2^140 possible hashes it could be. And of course they would then need a pre-image attack on SHA1 to deduce your actual password from that. More detail here: https://www.troyhunt.com/were-baking-have-i-been-pwned-into-firefox-and-1password/#enablinganonymoussearcheswithkanonymity https://www.troyhunt.com/were-baking-have-i-been-pwned-into-... Finally, I'm sure this option will be possible to disable, probably in settings but certainly in about:config.
- groovecoder 7y ago
  Answered here: https://news.ycombinator.com/item?id=20465981 https://news.ycombinator.com/item?id=20465981
- MrStonedOne 7y ago
  Why would it need to send the passwords? Could it not download a list of a every site that has ever been hacked along with their domain list and the date of the hacking, then warn you if you have a saved password for one of those domains that was saved before the domain was hacked? Because that's what it does.
verisimilitudes 7y ago
So, Firefox operates with yet another third party. I've never used this ''Have I been PWNed?'' drivel and don't intend to start, but I don't usually find myself using a Firefox-brand Firefox, either. What's so compelling about this website? To me, this looks like yet another silly idea people coalesce around and find important. In having a discussion about this, someone mentioned how it's not that different from Facebook and Cloudflare in managing something technical for those who don't care to, and I find this a rather decent comparison. This is yet another centralized and completely unnecessary entity. I don't see the appeal and I don't like what I regard as a stupid idea receiving so much attention from so many groups. This isn't surprising coming from Troy Hunt, however, who I best remember as the person bitching about an ad blocker blocking an ad he found acceptable.
- jedimastert 7y ago
  Do you maybe want to explain why you think it's a bad idea instead of spending three paragraphs dumping on it?
- groovecoder 7y ago
  Answered here: https://news.ycombinator.com/item?id=20465981 https://news.ycombinator.com/item?id=20465981

312 points by rahuldottech 7y ago

Firefox is using the wonderful haveibeenpwned resource. There is also a public API for haveibeenpwned if you want to incorporate it into your own clients: https://haveibeenpwned.com/API/v2 https://haveibeenpwned.com/API/v2 Please note rate limits/ abuse policy so everyone can use: https://haveibeenpwned.com/API/v2#RateLimiting https://haveibeenpwned.com/API/v2#RateLimiting (I am not affiliated)

jakejarvis 7y ago
1Password uses the HIBP API too [0] which has actually saved me a few times. The mechanics behind the v2 API (using k-anonymity with hashes [1]) are pretty interesting too. Troy has clearly put a lot of thought and time into what started as a pet project a few years ago and should be infinitely commended! [0] https://blog.1password.com/finding-pwned-passwords-with-1password/ https://blog.1password.com/finding-pwned-passwords-with-1pas... [1] https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/ https://www.troyhunt.com/ive-just-launched-pwned-passwords-v...
- waynesonfire 7y ago
  I just read through 1Password release notes [0], "Addressed a bug in the new popup where items were checked for vulnerable passwords even if you hadn't opted in to the Have I Been Pwned service." which also links to a KB article that talks about the security risks of HIBP [1] I would be very concerned if my credentials are being shared in _any_ form with 3rd parties without my explicit permissions. I hope this firefox feature is disabled by default. [0] https://app-updates.agilebits.com/product_history/B5X https://app-updates.agilebits.com/product_history/B5X [1] https://support.1password.com/kb/201907/ https://support.1password.com/kb/201907/
  - groovecoder 7y ago
    Disclaimer: I'm the Firefox sec engineer working on this feature. Just to clear this up: The code for this is actually way simpler and sends no data to either Mozilla nor HIBP. To prevent Firefox from sending data update pings to HIBP, Firefox Monitor maintains a copy of publicly available HIBP breaches and their metadata [1] in the Firefox "Remote Settings" service. [2] Using that data, Firefox simply checks for saved logins for breached sites where the saved password is older than the breach. [3] [1] https://haveibeenpwned.com/api/v2/breaches https://haveibeenpwned.com/api/v2/breaches [2] https://wiki.mozilla.org/Firefox/RemoteSettings https://wiki.mozilla.org/Firefox/RemoteSettings [3] https://hg.mozilla.org/mozilla-central/file/6484c07ff83649914781ddc9cfb70e98466cdd7a/browser/components/aboutlogins/AboutLoginsParent.jsm#l377 https://hg.mozilla.org/mozilla-central/file/6484c07ff8364991...
    - MrStonedOne 7y ago
      This explanation confused me, so let me rewrite it: "Firefox downloads a list of breached domain names and the date they were breached, and merely checks if you have any stored logins on any breached domains that are older then the breach date."
  - MrStonedOne 7y ago
    Credentials are not shared under the hibp password system. the first five characters of the hex encoded md5 of the password is shared and the server responds with matching hashes. If 20 bits (2 and a half characters) of hashed entropy can compromise your password you have bigger problems.
Deimorz 7y ago
Probably worth noting that Have I Been Pwned is now up for sale: https://www.troyhunt.com/project-svalbard-the-future-of-have-i-been-pwned/ https://www.troyhunt.com/project-svalbard-the-future-of-have... I've always been a huge fan of the project (and Troy) and understand that it's gotten to a point where he can't keep running it as a spare-time project, but I'm still not very happy about seeing it being shopped around. I can't see how this type of service needing to find a way to become a business will be a good thing overall, especially when it keeps getting integrated into other programs and services like this. Troy pledges that nothing will change, but every company getting acquired does that, and then things change anyway. The best result would probably be something like Mozilla buying it and/or paying Troy to just keep doing what he's doing.
- denzil_correa 7y ago
  > The best result would probably be something like Mozilla buying it and/or paying Troy to just keep doing what he's doing. Mozilla could very well be one of the potential candidates for HIBP ownership.
  - NeutronStar 7y ago
    Sure, but until then, nope.
  - bradknowles 7y ago
    Troy has spoken about that. They are a known candidate, but they fall further down the list on some of his criteria than he would like. However, he doesn't provide any further details on this issue. Meanwhile, he continues to look for other candidates.
- Mirioron 7y ago
  I would even say that a project like this should be run by the government(s). I get that foreign politics would wreck havoc there, but governments have to deal with data breaches anyway.
  - 7y ago
euroclydon 7y ago
One thing HIBP does is match a password against a list of half a billion leaked passwords without regard for the username portion of the credentials. They do it because of the NIST guidance to compare credentials to known data leaks. The same NIST who's previous guidance was a complicated password entropy algorithm, which they later dropped. I've always questioned the logic making 500,000,000 passwords off limits when no connection is made to the username. Work-factor hashing algorithms, rate limiting account locking and 2FA are supposed to protect user from brute force attacks. I think they can handle an attack based on 500 million possibilities. Now, if they matched the username/password pair, that would be great.
- tomschlick 7y ago
  The results show how often it was breached so you could always just blacklist passwords leaked more then 100 times or so. The really dangerous ones are the "common" one word passwords used hundreds of thousands of times.
  - deleted 7y ago
    [deleted]
- bradknowles 7y ago
  The thing is that all of the passwords in his database, are ones that the blackhats already know. As in, they not only have the hashes, but the full in-the-clear passwords. His sources for these lists are blackhats themselves, who happen to leak their copies of their password lists, one way or the other. And all the major password cracking tools will typically try all the known bad passwords, before they try anything else. And they'll try all known likely variants, before making any potential brute-force attempts. So, it doesn't matter if the password you want to use is on this list and you want to use it anyway, just because it has never been associated with your userid. The simple fact that you're trying to use a known bad password that has ever been used before by anyone else, is enough to increase by many, many orders of magnitude the likelihood that someone will be able to crack your new favourite password. Bad passwords are simply bad, regardless of who tries to use them. Some are worse than others, but they're all bad. This aspect of HIBP helps you discover if any of your passwords have ever been cracked by anyone, and therefore now on the list of known bad passwords.
cablej 7y ago
There are fundamental privacy risks to using the HIBP Pwned Passwords service which should be considered when implementing it. See my writeup here — https://cablej.io/blog/k-anonymity/ https://cablej.io/blog/k-anonymity/. In short, despite claims of protecting privacy, a malicious server can recover user passwords in some cases even if they haven’t previously been compromised.

bovermyer 7y ago

Is Firefox trying to replicate all behavior of password managers?

Groxx 7y ago
Browsers that offer to save your passwords are password managers. They've just been downright abhorrent at it for years. Improving that seems worth doing?
- woodrowbarlow 7y ago
  they certainly aren't as bad as they used to be, but the UX hasn't improved much. in-browser password managers these days have acceptable security and features like the one in the article are starting to surpass other password managers. but gawd, the UX. my biggest qualm with the UX of firefox's password manager is the "master password" feature. it's a password you must enter to unlock your keychain. that's a must-have for me. what firefox does wrong: * it's rendered as a simple dialog prompt, identical to javascript's window.prompt. could be faked by a site for phishing. * the unlock prompt launches once, about 30 seconds after the browser is launched (right while i'm in the middle of typing a URL) and grabs focus. * if you don't provide a password, the prompt will show up again each time you visit a page that has a login form for which you have a saved password, even if the login form is hidden with CSS. many sites have login forms on every page. * there's no way to unlock the keychain on a per-site basis or lock it again once you've unlocked it (besides closing the browser). what i want is: * when i'm about to log in to a site, i expect to provide my master password and have firefox autofill my saved password for this site only. * if i need the password again later, or a password for a different site, i expect to have to provide my master password again. * a dialogue that i can trust to have come from the browser itself rather than the webpage. * not to be interrupted by the dialogue unless i need to access a saved password.
  - Groxx 7y ago
    They seem to be working on the password manager in general lately(ish) e.g. https://lockwise.firefox.com/ https://lockwise.firefox.com/ , so I think there's a decent chance that side of things will improve. Because yeah, it has been an awful, nigh-unchanged experience for pretty much its whole existence.

qzw 7y ago

That’s a nice feature, and I hope other browsers will adopt something similar soon. Also looking forward to the password generator that’s finally coming in Firefox 69. On a slight tangent, I wish the major browsers would agree on an interoperability standard for their built-in password managers.

mnoorenberghe 7y ago
Press reports that this is shipping in Fx69 were incorrect.
- qzw 7y ago
  No? That’s a bummer. What’s the correct EVA (estimated version of arrival)?
r00fus 7y ago
> On a slight tangent, I wish the major browsers would agree on an interoperability standard for their built-in password managers. Are you talking about an interop standard for storing/sharing passwords, or for generating them? Because the latter is hobbled significantly by a twisting maze of password requirements and login form implementations by sites (banks, webmail, etc).
- vorpalhex 7y ago
  > an interop standard for storing/sharing passwords Is what we need. You can export from Chrome to a CSV, and you can import that CSV into 1Password, but no way to get those passwords into or out of Firefox that I've found (please tell me if you have a method..).
  - apetresc 7y ago
    > You can export from Chrome to a CSV, and you can import that CSV into 1Password, but no way to get those passwords into or out of Firefox that I've found (please tell me if you have a method..).* https://github.com/kspearrin/ff-password-exporter/blob/master/README.md#ff-password-exporter https://github.com/kspearrin/ff-password-exporter/blob/maste... :)

deleted 7y ago

[deleted]

java-man 7y ago

Does it mean your browser is going to leak your sites/account information to a third party? Will this feature be enabled by default? Can this be disabled?

SketchySeaBeast 7y ago
https://blog.mozilla.org/security/2018/06/25/scanning-breached-accounts-k-anonymity/ https://blog.mozilla.org/security/2018/06/25/scanning-breach...
- java-man 7y ago
  thank you.
snek 7y ago
haveibeenpwned doesn't accept plain-text passwords for checking, they use a k-anonymity model to protect both your passwords and the passwords in the database. the same goes for email addresses. https://haveibeenpwned.com/API/v2#SearchingPwnedPasswordsByRange https://haveibeenpwned.com/API/v2#SearchingPwnedPasswordsByR...
jsgo 7y ago
HIBP doesn't work that way really. You don't query for a site breach + email combination, you basically give your email address and then it returns back a list of breaches your email address was part of. As far as HIBP linking your email to specific breaches, well, it is essentially using public data sets so that disclosure exists already (before HIBP even enters the picture). They are a bit more reserved with certain cases (the Ashley Madison breach for example), but even then if someone wanted to locate email addresses in that breach, they'd just go get that data set.
- java-man 7y ago
  As long as this functionality can be disabled. This feature has a potential in connecting a browser (instance/session/ip) to an email (even in the form of abbreviated hash), which I would consider a security risk.

mwilliaams 7y ago

How does Firefox compare your actual password to the leaked password without storing your passwords in plaintext?

feanaro 7y ago
It is storing your passwords in plaintext locally, since this is about passwords that are saved by the user in Firefox's password store (the Saved Logins feature). These can (and should) be protected with a master password, but you obviously need to unlock the store before logging into a website. They're not storing your passwords remotely, though. They're asking haveibeenpwned which maintains a list of leaked login information from past breaches.
- jxcl 7y ago
  It looks like they're not doing this, but it is also possible to see if your exact password is in the breach using an algorithm called k-anonymity: https://blog.cloudflare.com/validating-leaked-passwords-with-k-anonymity/ https://blog.cloudflare.com/validating-leaked-passwords-with...
  - lucideer 7y ago
    Mozilla are using k-anonymity in their FirefoxMonitor service[0]. This feature syncs from FirefoxMonitor to a local browser DB and checks against that DB. However, I'm not 100% sure what data it syncs from FirefoxMonitor (obviously a subset, but I don't know how that's chosen. I'm not sure if they're using k-anon for requests between the Firefox browser and their own service). [0] https://github.com/mozilla/blurts-server/blob/master/hibp.js#L59 https://github.com/mozilla/blurts-server/blob/master/hibp.js...
want2know 7y ago
I believe the article is false. As far as I understand [1] Firefox will notice you if the domain was breached and your password is older than the breach. [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1559365 https://bugzilla.mozilla.org/show_bug.cgi?id=1559365

AznHisoka 7y ago

OK, enough is enough. I'm switching to Firefox now. Protip to Firefox: Advertise this feature more. The other stuff I don't really care about, and didn't really convinced me to move to Firefox. Fear is an excellent motivator, however.

numbers 7y ago
You will be happy with the move, if you're coming from Chrome, most extensions/add-ons are available on Firefox so the transition was not tough for me. There are some things like getting used to the dev tools but that shouldn't be too bad :)
- vorpalhex 7y ago
  I switched about two weeks ago. I had a few things I toggled in `about:config` but otherwise have been very happy. I appreciate how well Firefox works out of the box.
- Mirioron 7y ago
  Can I use my own custom addons with Firefox? Or do I still need a developer/unstable version of Firefox for that?
  - yuchi 7y ago
    I don’t know the _real_ answer but in the worst case scenario (“you can’t”) you can for sure use temporary add-ons in about:debug
mevile 7y ago
Try and give Firefox Containers a test too. It's a Firefox extension made by Mozilla that creates separate environments where cookies and session data are not shared. It's a great feature I never want to do without. I use it to create a wall between work and personal web browsing.
- Vinnl 7y ago

okasaki 7y ago

What data does this send and who receives it? Is money involved in this partnership? If so, who paid whom? What was the motivation behind this? Is there any study that shows any benefit from haveibeenpwned.com? I.e. has there been a decrease in hijacked accounts, etc?

Vinnl 7y ago
There's more about how Mozilla obtains the data here: https://www.troyhunt.com/were-baking-have-i-been-pwned-into-firefox-and-1password/#enablinganonymoussearcheswithkanonymity https://www.troyhunt.com/were-baking-have-i-been-pwned-into-... I don't think there's been studies, but it seems obvious to me that the goal here is to prevent re-use of leaked passwords, and I'd consider it a surprising result if this wouldn't help in that.
Deimorz 7y ago
CCP Games integrated it into Eve Online and says that it significantly reduced the number of players using insecure passwords: > When we first implemented the check, about 19% of logins were greeted with the message that their password was not safe enough. Today, this has dropped down to around 11-12% and hopefully will continue to go down. From https://www.eveonline.com/article/pu2gdi/account-security-improvements https://www.eveonline.com/article/pu2gdi/account-security-im...
groovecoder 7y ago
Answered here: https://news.ycombinator.com/item?id=20465981 https://news.ycombinator.com/item?id=20465981

Vinnl 7y ago

That sounds like a good reason to get your non-technical friends and relatives on Firefox. (Edit: though I wonder whether the really non-technical ones will not interpret this as having to change the displayed saved password, rather than having to visit the website.)

hartator 7y ago

How sending clear login and passwords to a third party website is ever a good idea?

hughes 7y ago
It isn't doing this. It uses rough hash of the password to generate a bucket ID that could represent a large number of passwords. That information is the used to query a bucket for whether any passwords in the bucket exist. For example, "password" hashes to "5DAA6", and the resulting bucket[1] lists secure hashes of several dozen passwords. The client then generates another hash of the password (eg. "1E4C9B93F3F0682250B6CF8331B7EE68FD8"), and checks if that secure hash is in the bucket (it is, "password" has been compromised at least 3,730,471 known times). [1]: https://api.pwnedpasswords.com/range/5BAA6 https://api.pwnedpasswords.com/range/5BAA6
- MrStonedOne 7y ago
  This is also false. Why would it need to send the passwords? Could it not download a list of a every site that has ever been hacked along with their domain list and the date of the hacking, then warn you if you have a saved password for one of those domains that was saved before the domain was hacked? Because that's what it does.
groovecoder 7y ago
Answered here: https://news.ycombinator.com/item?id=20465981 https://news.ycombinator.com/item?id=20465981

dicks-in-ur-ass 7y ago

SAVING PASSWORDS IS FUCKING GAY. JUST REMEMBER YOUR FUCKING LOGIN.

Endy 7y ago

So you're saying that the browser client will now be regularly sending secure information on a regular basis to a predictable IP, across HTTP (hopefully S, but I'm sure there will be a fallback), via dynamic path and across an unknown number of hops for transit. And this is supposed to be more secure. I'm sure there's nothing to go wrong with that wonderful plan! Taking control away from the user is a great idea! Except that it's not.

ekimekim 7y ago
The haveibeenpwned API uses a k-anonymity model, so that the client can check a password in an efficient fashion (ie. without downloading the entire list of pwned hashes), without also revealing the hash you're trying to check. Basically, it asks for all pwned hashes that start with the same 5 characters as your password's (hex-encoded) hash. So yes, there is an information leak (the first 5 characters of your hash), but it's an extremely unimportant one. Even knowing the first 5 characters, there's still 2^140 possible hashes it could be. And of course they would then need a pre-image attack on SHA1 to deduce your actual password from that. More detail here: https://www.troyhunt.com/were-baking-have-i-been-pwned-into-firefox-and-1password/#enablinganonymoussearcheswithkanonymity https://www.troyhunt.com/were-baking-have-i-been-pwned-into-... Finally, I'm sure this option will be possible to disable, probably in settings but certainly in about:config.
groovecoder 7y ago
Answered here: https://news.ycombinator.com/item?id=20465981 https://news.ycombinator.com/item?id=20465981
MrStonedOne 7y ago
Why would it need to send the passwords? Could it not download a list of a every site that has ever been hacked along with their domain list and the date of the hacking, then warn you if you have a saved password for one of those domains that was saved before the domain was hacked? Because that's what it does.

verisimilitudes 7y ago

So, Firefox operates with yet another third party. I've never used this ''Have I been PWNed?'' drivel and don't intend to start, but I don't usually find myself using a Firefox-brand Firefox, either. What's so compelling about this website? To me, this looks like yet another silly idea people coalesce around and find important. In having a discussion about this, someone mentioned how it's not that different from Facebook and Cloudflare in managing something technical for those who don't care to, and I find this a rather decent comparison. This is yet another centralized and completely unnecessary entity. I don't see the appeal and I don't like what I regard as a stupid idea receiving so much attention from so many groups. This isn't surprising coming from Troy Hunt, however, who I best remember as the person bitching about an ad blocker blocking an ad he found acceptable.

jedimastert 7y ago
Do you maybe want to explain why you think it's a bad idea instead of spending three paragraphs dumping on it?
groovecoder 7y ago
Answered here: https://news.ycombinator.com/item?id=20465981 https://news.ycombinator.com/item?id=20465981