Firefox to Warn When Saved Logins Are Found in Data Breaches

Re:Firefox to Warn When Saved Logins Are Found in Data Breaches by groovecoder on Wednesday July 17, 2019 @09:55PM (#20465981)

Disclaimer: I'm the Firefox sec engineer working on this feature.

Just to clear this up: The code for this is actually way simpler and sends no data to either Mozilla nor HIBP. To prevent Firefox from sending data update pings to HIBP, Firefox Monitor maintains a copy of publicly available HIBP breaches and their metadata [1] in the Firefox "Remote Settings" service. [2]

Using that data, Firefox simply checks for saved logins for breached sites where the saved password is older than the breach. [3]

[1] https://haveibeenpwned.com/api/v2/breaches [2] https://wiki.mozilla.org/Firefox/RemoteSettings [3] https://hg.mozilla.org/mozilla-central/file/6484c07ff8364991...

[ Parent | on HN ]

Re:Firefox to Warn When Saved Logins Are Found in Data Breaches by MrStonedOne on Wednesday July 17, 2019 @10:24PM (#20466145)

This explanation confused me, so let me rewrite it:

"Firefox downloads a list of breached domain names and the date they were breached, and merely checks if you have any stored logins on any breached domains that are older then the breach date."

[ Parent | on HN ]