News for hackers. Stuff that matters.

A comment on Firefox to Warn When Saved Logins Are Found in Data Breaches. Parent comment

Re:Firefox to Warn When Saved Logins Are Found in Data Breaches by feanaro on Wednesday July 17, 2019 @01:10PM (#20461693)
It is storing your passwords in plaintext locally, since this is about passwords that are saved by the user in Firefox's password store (the Saved Logins feature). These can (and should) be protected with a master password, but you obviously need to unlock the store before logging into a website.

They're not storing your passwords remotely, though. They're asking haveibeenpwned which maintains a list of leaked login information from past breaches.

[ Parent | on HN ]
Re:Firefox to Warn When Saved Logins Are Found in Data Breaches by jxcl on Wednesday July 17, 2019 @01:18PM (#20461810)
It looks like they're not doing this, but it is also possible to see if your exact password is in the breach using an algorithm called k-anonymity:

https://blog.cloudflare.com/validating-leaked-passwords-with...

[ Parent | on HN ]
Re:Firefox to Warn When Saved Logins Are Found in Data Breaches by lucideer on Wednesday July 17, 2019 @02:00PM (#20462275)
Mozilla are using k-anonymity in their FirefoxMonitor service[0]. This feature syncs from FirefoxMonitor to a local browser DB and checks against that DB. However, I'm not 100% sure what data it syncs from FirefoxMonitor (obviously a subset, but I don't know how that's chosen. I'm not sure if they're using k-anon for requests between the Firefox browser and their own service).

[0] https://github.com/mozilla/blurts-server/blob/master/hibp.js...

[ Parent | on HN ]