Looks like this doesn't include another feature of HaveIBeenPwned. Its cracked password hash database. If you trust their JavaScript, you can type in your passwords and see if they are on the list. If you're a little more paranoid you can download the hashes and do your own search.
Firefox Monitor
11–20 of 227 posts
Re: Firefox Monitor
#12I checked my email address and it says my data was lost by verifications.io. I've never heard of that site before and going there didn't reveal any clues.
I googled the name and found a report [1] on the breach. They lost control of records on 2 billion email addresses.
[1]: https://www.forbes.com/sites/daveywinder/2019/03/10/2-billio...
Re: Firefox Monitor
#13Looks like this doesn't include another feature of HaveIBeenPwned. Its cracked password hash database. If you trust their JavaScript, you can type in your passwords and see if they are on the list. If you're a little more paranoid you can download the hashes and do your own search.
Since this service appears to be deliberately aimed at non-tech-savvy users, I get the impression that Mozilla is trying to not normalize the practice of submitting your passwords to third-party websites. It also nimbly sidesteps any questions of "why should I trust firefox.com with my password"; you don't need to, because you're not giving it to them.
Re: Firefox Monitor
#14Looks like this doesn't include another feature of HaveIBeenPwned. Its cracked password hash database. If you trust their JavaScript, you can type in your passwords and see if they are on the list. If you're a little more paranoid you can download the hashes and do your own search.
Mozilla have a password saving app, not checked but I wouldn't be surprised if that is a feature and may have inspired this collaboration.
Re: Firefox Monitor
#15Mozilla and Apple, lately, are the only companies I trust my data to. Nice to see more from both.
I find it difficult to trust Apple for security considering their morally bankrupt behaviour in rest of their business. They have proven their sole principle is monetary, so I find it difficult to perceive their recent claim to care about user security as anything beyond opportunism.
Re: Firefox Monitor
#16How does this relate to HaveIBeenPwned.com? Is it a separate effort? Does it have more data? Is it built on top of their data? I've seen other services (like 1Password) just rely on HaveIBeenPwned because it's pretty solid – seems like it would be nice for the industry to coalesce around it and build these kinds of alerting features on top of it.
When you submit your email after the breaches list there's this notice "Breach data provided by Have I Been Pwned", so I guess it's a joint effort.
Yes, exactly. It's on the bottom of every breach page too:
> Breach data provided by Have I Been Pwned
I love that it's a visually engaging and simple way of showing breaches. It's going to be a lot easier to share this with family, then get them on a password manager.
Re: Firefox Monitor
#17How does this relate to HaveIBeenPwned.com? Is it a separate effort? Does it have more data? Is it built on top of their data? I've seen other services (like 1Password) just rely on HaveIBeenPwned because it's pretty solid – seems like it would be nice for the industry to coalesce around it and build these kinds of alerting features on top of it.
When you submit your email after the breaches list there's this notice "Breach data provided by Have I Been Pwned", so I guess it's a joint effort.
HaveIBeenPwned provides the same notification service.
So why is Mozilla running an email harvesting campaign?
Re: Firefox Monitor
#18I checked my email address and it says my data was lost by verifications.io. I've never heard of that site before and going there didn't reveal any clues. I googled the name and found a report [1] on the breach. They lost control of records on 2 billion email addresses. [1]: https://www.forbes.com/sites/daveywinder/2019/03/10/2-billio...
I'm in that list as well, don't remember ever signing up for it.
Re: Firefox Monitor
#19Looks like this doesn't include another feature of HaveIBeenPwned. Its cracked password hash database. If you trust their JavaScript, you can type in your passwords and see if they are on the list. If you're a little more paranoid you can download the hashes and do your own search.
Well with the API it’s pretty easy to test your password. You just have to hash it, send the 5 first characters and it returns the list of the hashes starting with those 5 characters.
You then just check.
Re: Firefox Monitor
#20Mozilla and Apple, lately, are the only companies I trust my data to. Nice to see more from both.
I find it difficult to trust Apple for security considering their morally bankrupt behaviour in rest of their business. They have proven their sole principle is monetary, so I find it difficult to perceive their recent claim to care about user security as anything beyond opportunism.
A large chunk of their marketing nowadays is around privacy and it looks like it's more and more in their priorities, and Apple is a company that has historically loved by suckling at their customers sweet wallety nectar.
So yeah even if they're driven by money, their best interest is aligned with their customers'- living up to the promise that your data is yours with them.
The other thing is that there seems to be a better chance at being private with a company that does not start its promise by telling they want to know everything about you and "index the world"