Firefox Will Warn Users When Visiting Sites That Suffered a Data Breach (bleepingcomputer.com) 64
An anonymous reader writes: Mozilla engineers are working on a notifications system for Firefox that shows a security warning to users visiting sites that have suffered data breaches. The notifications system will use data provided by Have I Been Pwned?, a website that indexes public data breaches and allows users to search and see if their details have been compromised in any of these incidents. Work on this project has only recently started. The code to show these warnings is not even in the Firefox codebase but managed separately as an add-on available (on GitHub). The alert also includes an input field. In the add-ons current version this field doesn't do anything, but we presume it's there to allow users to search and see if their data was exposed during that site's security breach. Troy Hunt, Have I Been Pwned's author has confirmed his official collaboration with Mozilla on this feature.
Yes! (Score:5, Insightful)
Finally, a feature that makes me want to use Firefox.
Except how useful is this given that it's going to warn me about every single site I visit?
Re: Yes! (Score:2)
Re: Yes! (Score:5, Funny)
Re: (Score:2)
Finally, a feature that makes me want to use Firefox.
Except how useful is this given that it's going to warn me about every single site I visit?
Look on the bright side, at least you'll get a giggle out of seeing a warning banner with an announcement that reads something like this 'Warning: This organisation was hacked by the Russian intelligence services due to the utterly inadequate security measures employed by this organisation.' every time you visit gop.org and democrats.org.
Re: (Score:1)
Except how useful is this given that it's going to warn me about every single site I visit?
From the fine article it seems like the focus is on prompting people to change their password when a site has been compromised.
But I think there could be a much greater value. I think part of the problem is that users just don't know how shitty websites are at protecting their personal data. When there is a major breach it is big news... for 15 minutes and then some other news story captures the spotlight and everybody forgets.
Putting a big bright sign right on the website itself whenever people use it wi
Re:Yes! (Score:4, Interesting)
I wonder if it might give people a false sense of security. Just because a site isn't flagged up doesn't mean it hasn't been hacked or is secure.
Re: (Score:2)
People want theatre. Not real security, with the inconvenience that entails.
Anyhow, I don't think this will happen, or if it does, it won't survive for long.
There are plenty of big companies that would sue the living shat out of the Mozilla Foundation if they do this, calling it anti-competitive. If the warning is perceived to make even a single potential customer leave the web site, they'll call in their army of lawyers and pull strings on the politicos they bought.
Re: (Score:1)
Except my browser doesn't send my data to a third party like Firefox does.
Re: (Score:1)
Re: (Score:2)
Your use of the verb "know" implies a sentience.
Harvesting the sites I visit (Score:1)
Re:Harvesting the sites I visit (Score:5, Informative)
So now, Firefox will be tracking and harvesting the sites I visit? Wow, Mozilla really is turning Firefox into a Chrome clone.
Having looked at the code: No, it downloads a breach list from here: https://stage.haveibeenpwned.c... [haveibeenpwned.com] It does not send all your browsing history to them.
If you enter your email address that will be the sent to the site for checking, but that's obviously optional.
Re: (Score:2)
As is Mozilla could actually afford the infrastructure needed to handle the sheer amount of requests from their 5% market share...
Re: Privacy (Score:1)
Just go to about:config then set:
HasHaveIBeenPawnedBeenPawned to 1
Re:Privacy (Score:5, Insightful)
Why am I reading this as "Firefox will share your browsing history with another partner."
Probably because you have a bias.
Is this list downloaded and compared locally? I doubt it too.
Yes, this is exactly how it works. It downloads a list from here: https://stage.haveibeenpwned.c... [haveibeenpwned.com]
The beauty of open source code is you can see how it works, if you aren't too lazy to just not bother.
"Just a list" is still notifying about activity. (Score:2)
The underlying problem? One problem that the management of mozilla.org has is being very poor at communicating. It is common that technically-knowledgeable people don't communicate well. It is common that even people who are especially socially capable make mistakes by communicating in a flawed way.
Another example of poor communication: Mozilla.org management did not handle communicating the
Re:"Just a list" is still notifying about activity (Score:4, Informative)
Even if Firefox only downloads a list, it is still giving information about your activity to another web site.
Yes, it tells a site that someone at your ip address (which much of the time is likely to be a DHCP address from your ISP) uses Firefox. I'm struggling to think of a serious enough situation that could arise from that to justify your level of outrage.
The underlying problem? One problem that the management of mozilla.org has is being very poor at communicating. It is common that technically-knowledgeable people don't communicate well. It is common that even people who are especially socially capable make mistakes by communicating in a flawed way.
Funny because you already seem to know all you need to about this functionality (and you clearly don't like it) and it isn't even part of Firefox yet and may well never be.
Another example of poor communication: Mozilla.org management did not handle communicating the move to Firefox 57 well. People use Firefox because of the availability of add-ons, also known as extensions. (Communicate carefully: Don't give 1 thing 2 names.) Preventing use of most add-ons without a careful public explanation tended to cause people to lose confidence in Mozilla.org and begin using Waterfox or Pale Moon browsers.
I wondered when we'd get to WebExtensions - every haters current favourite stick to beat Mozilla with.
You must have been out when they came door to door to tell you about the pending changes, but I'm not sure how you missed the sky writers and the leaflet drops! Seriously, what do you want from them? You're blaming the wrong people here anyway. Mozilla gave developers 2 years warning about support for the old addons system being dropped. They have been marking your addons as legacy to help warn people they need to get them updated for some time too, if you want something more user focused. Then of course there is reading the Mozilla site, update notes, etc. That doesn’t seem like an unreasonable suggestion - to occasionally look at the site of, or release notes for, a software product you use on a daily basis.
Unfortunately most addon developers didn't bother to update their addons in a timely manner. That left them scurrying to fix their addons at the last minute to fit around a timetable they knew about for 2 years. I am aware that not everything that could be done with addons can be ported to the new system, but if addon developers had made a bit of effort sooner they could have influenced the WebExtension support and perhaps got additions made to the API. I’m not sure the Mozilla developers have always been as responsive to suggestions as would be liked, but more people getting involved at an earlier stage would almost certainly have worked out better.
It was only by dropping the old addon system that they were able to give us a new, fast, efficient browser to keep up with the likes of Chrome. I'm sure most of the people whining about the change were also whining about how far behind Firefox was getting. And performance wasn't the only problem with the old system - no permissions system, no security, addons breaking from release to release of Firefox, etc.
Re: (Score:1)
It's fortunately for them because they have better things to do with their free time. Who cares about Mozilla anymore ?
Does switching to Chrome, Pale Moon or Brave count as "whining" ?
My initial reaction was incorrect. (Score:2)
The Slashdot summary and the stories linked in the summary don't mention that Mozilla is apparently merely copying the Google Chrome browser: Manage warnings about u [google.com]
Re: (Score:2)
don't mention that Mozilla is apparently merely copying the Google Chrome browser
No, this is a separate issue. Firefox has long had attack site warnings [mozilla.org]. I think Internet Explorer was the first to have unsafe site warnings starting with Internet Explorer 7 [wikipedia.org] 11 years ago, so everyone's copying Microsoft.
Re: (Score:2)
Comment removed (Score:4, Insightful)
Next step: totally unbiased fact checking built-in (Score:1)
When Mozilla starts annotating sites you visit, I wonder how long until they copy Google and automatically show totally unbiased and neutral "fact checkers" when you visit an offensive website? They already have their own ministry of truth initiative after all: https://blog.mozilla.org/blog/2017/08/08/mozilla-information-trust-initiative-building-movement-fight-misinformation-online/
I would like to be warned of session replay script (Score:2)
https://freedom-to-tinker.com/... [freedom-to-tinker.com]
I already have a script to do that... (Score:2)
It just throws up a warning icon and leaves it there regardless of what site I visit.
ANY site you allow to run client-side scripts should be assumed to be logging your activity. Any site you give personal information to should be assumed to be either selling it or at imminent risk of having it stolen. Or both.
That's not even paranoia, that's just common bloody sense; it's what financial self interest on the part of content providers and hackers leads to.
Corporate response should be amusing (Score:2)
They -HATE- having to report such incidents as it is and only do so because they have to.
Nothing like a glaring spotlight on your front door that says " Your personal information isn't safe with us " to help your customers feel at ease.
Maybe the List of Shame will motivate corporate folks to secure their networks and quit treating their IT / Network Security as an expense instead of an investment.
Maybe.
But I doubt it.
They'll just whine to Congress about how unfair it is that they're getting picked on and ho
Have I been Pwnd (Score:1)
They are obviously collecting email and IP addresses
Overload (Score:2)
Waaaay too late (Score:4, Funny)
Nice try, but I want a plug-in that warns me a website is GOING to be breached, rather than 'it already has been breached'. Can someone code that up please?
Re: (Score:2)
return true; // accurate to 1 decimal place
}
Re: (Score:2)
No warning == brand new site? (Score:2)
So this is going to be like all the "...known to the state of California to cause cancer and birth defects." warnings which are present of every hotel, store, and most products sold in California. While warning about data breaches may be a good sounding idea, in practice this will turn into "this is a brand new company" indicator, i.e. "no warning about data breach means they are brand new to the internet"
A better idea would be to provide details about time, size and handling of every known breach (how quic