Disclaimer: I'm the Firefox sec engineer working on this feature. Just to clear this up: The code for this is actually way simpler and sends no data to either

Disclaimer: I'm the Firefox sec engineer working on this feature. Just to clear this up: The code for this is actually way simpler and sends no data to either Mozilla nor HIBP. To prevent Firefox from sending data update pings to HIBP, Firefox Monitor maintains a copy of publicly available HIBP breaches and their metadata [1] in the Firefox "Remote Settings" service. [2] Using that data, Firefox simply checks for saved logins for breached sites where the saved password is older than the breach. [3] [1] https://haveibeenpwned.com/api/v2/breaches https://haveibeenpwned.com/api/v2/breaches [2] https://wiki.mozilla.org/Firefox/RemoteSettings https://wiki.mozilla.org/Firefox/RemoteSettings [3] https://hg.mozilla.org/mozilla-central/file/6484c07ff83649914781ddc9cfb70e98466cdd7a/browser/components/aboutlogins/AboutLoginsParent.jsm#l377 https://hg.mozilla.org/mozilla-central/file/6484c07ff8364991...