Mozilla to Build Have I Been Pwned Function into Firefox

[Exterminator]

Mozilla has announced an integration of the breach alerting service Have I Been Pwned to alert users about data breaches through the Firefox UI and offer educational information.

According to updates from Mozilla and Github, this will offer users a notification when they visit a site (or maybe when they focus a form on a login page) known to have recently been breached, and offer a way for interested users to learn about and opt-in to a service that notifies them (e.g. via email) when they may be affected by breaches in the future.

Github claimed that this is an extension that will be used “as a vehicle for prototyping basic UI and interaction flow for an upcoming feature in Firefox that notifies users when their credentials have possibly been leaked or stolen in a data breach.”

Security consultant and Have I Been Pwned founder Troy Hunt told Infosecurity that this is an integration it is looking at, and a lot comes down to a combination of the UX within the browser and how the privacy of data is protected.

“What I can say for sure is that no passwords will be involved here – I don’t store them nor do I provide any means of querying them and I won’t be providing them to anyone else either, but obviously HIBP provides other easily accessible services such as listing breaches (and their domains) as well as enabling search by email address.

“I’m pleased to see Mozilla wanting to bring the issue of these breaches to the forefront of people’s minds, especially given the reach they have via Firefox, they have the opportunity to raise awareness at a pretty serious scale.”

With regards to privacy concerns, Mozilla developers said that it is understanding the concept of who the custodian of data would be, how can data avoid being sent to HIBP, and can useful functionality be offered to users who opt-out of subscribing their email address. “While the project is still in infancy, the idea is to offer as much utility as possible while respecting the user's privacy."

 

[oneeye]

Troy Hunt has a pretty good blog and podcast. I've been subscribed for some time now. But, I follow the infosec community rather closely like the majority here do.