4 ms·

Wait, Firefox Monitor? As in "allow us to store your email and password in case your email and password are pwned in some other site"? Does anyone else think th

Wait, Firefox Monitor? As in "allow us to store your email and password in case your email and password are pwned in some other site"? Does anyone else think this is prone to disaster, eventually?

uncletaco 7y ago
It's more like "share your email and if it turns up in a leak we'll inform you." Some password managers already do this and I personally think its a nice feature. Though I often generate new emails and passwords for sites on the spot so this feature isn't of much use to me.
sequence7 7y ago
Firefox monitor doesn't store your password. It simply checks your email address/addresses against known breaches.
wlesieutre 7y ago
>How does Firefox Monitor know I was involved in these breaches? >Firefox Monitor gets its data breach information from a publicly searchable source, Have I Been Pwned. If you don’t want your email address to show up in this database, visit the opt-out page. https://support.mozilla.org/en-US/kb/firefox-monitor-faq https://support.mozilla.org/en-US/kb/firefox-monitor-faq
leevlad 7y ago
Pretty sure it's keyed on your email alone. Not sure where you saw anything about passwords.
input_sh 7y ago
They only store an email address and let you know if that email address ever appears in a breach. They don't know your password, they're not asking for your password, and they're not interested in your password. Also, knowing your password wouldn't be enough to identify it within a breach, assuming that the breached website does the bare minimum to store them safely (as in, uses a salt). How about reading a thing or two before jumping to conclusions?
yes-except-no 7y ago
Firefox Monitor does not do that. They store a hash of your email, and contacts Have I Been Pwned.
TeMPOraL 7y ago
This is Firefox frontend to HaveIBeenPwnd.
shakna 7y ago
It utilises K-anonymity, making it difficult if not impossible for this to become a massive data leak. The email gets hashed on your device, and the start of that hash is sent off to the server. The server returns a list of all the hashes that might match. The client then checks that list for complete matches.
- megous 7y ago
  Sounds fairly reasonable. I was already getting afraid of my private email addresses being leaked via this check.
erichdongubler 7y ago
Two things about that in reply to your comment: 1. Right now Firefox Monitor uses your Firefox account for signups. For somebody like me who already has a Firefox account, I don't see a net difference in risk here. 2. If you don't want to make one, then Monitor is transparent in that they just use https://haveibeenpwned.com https://haveibeenpwned.com under the hood (source: https://support.mozilla.org/en-US/kb/firefox-monitor-faq#w_how-does-firefox-monitor-know-i-was-involved-in-these-breaches https://support.mozilla.org/en-US/kb/firefox-monitor-faq#w_h...), which doesn't require anything more than submitting your email and passing their Google captcha. It's unfortunate that they're not more forthcoming about this, but the option is there.
dantondwa 7y ago
Actually, today Firefox Monitor popped up and told me that a website I was using (Canva, I need it for work reasons) was recently hacked. My account was also compromised. Canva didn't even bother to inform me of the fact. I think this is a great functionality and it will really help the average user.

Wait, Firefox Monitor? As in "allow us to store your email and password in case your email and password are pwned in some other site"? Does anyone else think this is prone to disaster, eventually?

uncletaco 7y ago

It's more like "share your email and if it turns up in a leak we'll inform you." Some password managers already do this and I personally think its a nice feature. Though I often generate new emails and passwords for sites on the spot so this feature isn't of much use to me.

sequence7 7y ago

Firefox monitor doesn't store your password. It simply checks your email address/addresses against known breaches.

wlesieutre 7y ago

>How does Firefox Monitor know I was involved in these breaches? >Firefox Monitor gets its data breach information from a publicly searchable source, Have I Been Pwned. If you don’t want your email address to show up in this database, visit the opt-out page. https://support.mozilla.org/en-US/kb/firefox-monitor-faq https://support.mozilla.org/en-US/kb/firefox-monitor-faq

leevlad 7y ago

Pretty sure it's keyed on your email alone. Not sure where you saw anything about passwords.

input_sh 7y ago

They only store an email address and let you know if that email address ever appears in a breach. They don't know your password, they're not asking for your password, and they're not interested in your password. Also, knowing your password wouldn't be enough to identify it within a breach, assuming that the breached website does the bare minimum to store them safely (as in, uses a salt). How about reading a thing or two before jumping to conclusions?

yes-except-no 7y ago

Firefox Monitor does not do that. They store a hash of your email, and contacts Have I Been Pwned.

TeMPOraL 7y ago

This is Firefox frontend to HaveIBeenPwnd.

shakna 7y ago

It utilises K-anonymity, making it difficult if not impossible for this to become a massive data leak. The email gets hashed on your device, and the start of that hash is sent off to the server. The server returns a list of all the hashes that might match. The client then checks that list for complete matches.

megous 7y ago
Sounds fairly reasonable. I was already getting afraid of my private email addresses being leaked via this check.

erichdongubler 7y ago

Two things about that in reply to your comment: 1. Right now Firefox Monitor uses your Firefox account for signups. For somebody like me who already has a Firefox account, I don't see a net difference in risk here. 2. If you don't want to make one, then Monitor is transparent in that they just use https://haveibeenpwned.com https://haveibeenpwned.com under the hood (source: https://support.mozilla.org/en-US/kb/firefox-monitor-faq#w_how-does-firefox-monitor-know-i-was-involved-in-these-breaches https://support.mozilla.org/en-US/kb/firefox-monitor-faq#w_h...), which doesn't require anything more than submitting your email and passing their Google captcha. It's unfortunate that they're not more forthcoming about this, but the option is there.

dantondwa 7y ago

Actually, today Firefox Monitor popped up and told me that a website I was using (Canva, I need it for work reasons) was recently hacked. My account was also compromised. Canva didn't even bother to inform me of the fact. I think this is a great functionality and it will really help the average user.