Slashdot Mirror
Firefox Will Warn Users When Visiting Sites That Suffered a Data Breach (bleepingcomputer.com)
An anonymous reader writes: Mozilla engineers are working on a notifications system for Firefox that shows a security warning to users visiting sites that have suffered data breaches. The notifications system will use data provided by Have I Been Pwned?, a website that indexes public data breaches and allows users to search and see if their details have been compromised in any of these incidents. Work on this project has only recently started. The code to show these warnings is not even in the Firefox codebase but managed separately as an add-on available (on GitHub). The alert also includes an input field. In the add-ons current version this field doesn't do anything, but we presume it's there to allow users to search and see if their data was exposed during that site's security breach. Troy Hunt, Have I Been Pwned's author has confirmed his official collaboration with Mozilla on this feature.
Finally, a feature that makes me want to use Firefox.
Except how useful is this given that it's going to warn me about every single site I visit?
So now, Firefox will be tracking and harvesting the sites I visit? Wow, Mozilla really is turning Firefox into a Chrome clone.
Why am I reading this as "Firefox will share your browsing history with another partner."
Is this list downloaded and compared locally? I doubt it too. Which means they have to send the URL to someone and ask if it is okay.
This better have a disable option. Ideally it would be in the privacy tab and not buried in the config file.
bool CheckSiteForBreach(string URL)
{
return true;
}
Done!
And if it isn't bug-free yet, just wait a little while, it will be.
... Given that CAs aren't trustworthy, just because they or Mozilla say so.
Yes, if it is your own CA, then TLS might be OK.
But trusting some random CA employees is equivalent to having no encryption at all.
Or do you trust the first person coming out an office building to keep all your secrets?
Hmm, I don't think that's going to work. I mean, in this day and age, it'd be easier to maintain a list of sites that haven't suffered such!
When Mozilla starts annotating sites you visit, I wonder how long until they copy Google and automatically show totally unbiased and neutral "fact checkers" when you visit an offensive website? They already have their own ministry of truth initiative after all: https://blog.mozilla.org/blog/2017/08/08/mozilla-information-trust-initiative-building-movement-fight-misinformation-online/
You may know that some websites use scripts to record everything from a session, every keystroke and mouse move. And they don't feel oblidged to inform you that they are doing this.
https://freedom-to-tinker.com/...
Signature deleted by lameness filter.
It just throws up a warning icon and leaves it there regardless of what site I visit.
ANY site you allow to run client-side scripts should be assumed to be logging your activity. Any site you give personal information to should be assumed to be either selling it or at imminent risk of having it stolen. Or both.
That's not even paranoia, that's just common bloody sense; it's what financial self interest on the part of content providers and hackers leads to.
Even if Firefox only downloads a list, it is still giving information about your activity to another web site.
The underlying problem? One problem that the management of mozilla.org has is being very poor at communicating. It is common that technically-knowledgeable people don't communicate well. It is common that even people who are especially socially capable make mistakes by communicating in a flawed way.
Another example of poor communication: Mozilla.org management did not handle communicating the move to Firefox 57 well. People use Firefox because of the availability of add-ons, also known as extensions. (Communicate carefully: Don't give 1 thing 2 names.) Preventing use of most add-ons without a careful public explanation tended to cause people to lose confidence in Mozilla.org and begin using Waterfox or Pale Moon browsers.
They -HATE- having to report such incidents as it is and only do so because they have to.
Nothing like a glaring spotlight on your front door that says " Your personal information isn't safe with us " to help your customers feel at ease.
Maybe the List of Shame will motivate corporate folks to secure their networks and quit treating their IT / Network Security as an expense instead of an investment.
Maybe.
But I doubt it.
They'll just whine to Congress about how unfair it is that they're getting picked on and how it's hurting their business.
You and I just roll our eyes at such things, but Congress does stupid things when enough bribe . . . . er. . . campaign donations are on the line.
I would expect a silly response from them soon enough.
Seriously, can't the existing stuff work properly before you start adding new features?
Browsers, office software, these are utilitarian applications. The basics should work well, virtually 100%. Instead, bugs and functionality issues linger for years while the shiny new new keeps getting added to the pile.
Go back to making the best browser. Only then start thinking about new features.
They are obviously collecting email and IP addresses
Because that won't be abused...
Every site I'd ever visit would light up like a Christmas tree with warnings. I'll give it two weeks before those annoying auto add ons block these warnings.
Even if Firefox only downloads a list, it is still giving information about your activity to another web site.
Yes, it tells a site that someone at your ip address (which much of the time is likely to be a DHCP address from your ISP) uses Firefox. I'm struggling to think of a serious enough situation that could arise from that to justify your level of outrage.
The underlying problem? One problem that the management of mozilla.org has is being very poor at communicating. It is common that technically-knowledgeable people don't communicate well. It is common that even people who are especially socially capable make mistakes by communicating in a flawed way.
Funny because you already seem to know all you need to about this functionality (and you clearly don't like it) and it isn't even part of Firefox yet and may well never be.
Another example of poor communication: Mozilla.org management did not handle communicating the move to Firefox 57 well. People use Firefox because of the availability of add-ons, also known as extensions. (Communicate carefully: Don't give 1 thing 2 names.) Preventing use of most add-ons without a careful public explanation tended to cause people to lose confidence in Mozilla.org and begin using Waterfox or Pale Moon browsers.
I wondered when we'd get to WebExtensions - every haters current favourite stick to beat Mozilla with.
You must have been out when they came door to door to tell you about the pending changes, but I'm not sure how you missed the sky writers and the leaflet drops! Seriously, what do you want from them? You're blaming the wrong people here anyway. Mozilla gave developers 2 years warning about support for the old addons system being dropped. They have been marking your addons as legacy to help warn people they need to get them updated for some time too, if you want something more user focused. Then of course there is reading the Mozilla site, update notes, etc. That doesn’t seem like an unreasonable suggestion - to occasionally look at the site of, or release notes for, a software product you use on a daily basis.
Unfortunately most addon developers didn't bother to update their addons in a timely manner. That left them scurrying to fix their addons at the last minute to fit around a timetable they knew about for 2 years. I am aware that not everything that could be done with addons can be ported to the new system, but if addon developers had made a bit of effort sooner they could have influenced the WebExtension support and perhaps got additions made to the API. I’m not sure the Mozilla developers have always been as responsive to suggestions as would be liked, but more people getting involved at an earlier stage would almost certainly have worked out better.
It was only by dropping the old addon system that they were able to give us a new, fast, efficient browser to keep up with the likes of Chrome. I'm sure most of the people whining about the change were also whining about how far behind Firefox was getting. And performance wasn't the only problem with the old system - no permissions system, no security, addons breaking from release to release of Firefox, etc.
Nice try, but I want a plug-in that warns me a website is GOING to be breached, rather than 'it already has been breached'. Can someone code that up please?
- The Kessel run is for nerf herders. I can circumnavigate the entire Central Finite Curve in a lot less than 12 parse
Given that Putin was installed by US puppet Boris Yeltsin ...
Will I receive a warning every time I perform a search in Firefox's default search field? That will get annoying fast.
Google Employees Hit by Sabre Breach - http://www.securityweek.com/go...
What about submitting a Firefox bug? They've been breached too.
Mozilla admits bug-tracker breach led to attacks against Firefox users - https://www.computerworld.com/...
I agree with almost everything you said, except " if addon developers had made a bit of effort sooner they could have influenced the WebExtension support and perhaps got additions made to the API". Mozilla's current lead developers have directly refused to allow functionality they believe is unnecessary and are publicly unwilling to even entertain that this might be incorrect, despite points made by previous Mozilla developers. This is (I believe) the core of the issue some people exaggerate about the org.
That said, this prototype concept is a good one for personal security, so I hop it is included.
It's fortunately for them because they have better things to do with their free time. Who cares about Mozilla anymore ?
Does switching to Chrome, Pale Moon or Brave count as "whining" ?
>People use Firefox because of the availability of add-ons
Um, not even half of them do so for the add-ons, and most of those don't even use more than an adblocker and a couple of popular addons that are already ported. The "problem" here is not just that Mozilla isn't communicating well, but that other people are quick to jump on that and misinform people, acting like everyone who uses Firefox is like them, and Mozilla needs to cater to their needs first and foremost, or it's a "problem".
Thankfully this is changing for the better. The people who feel this way aren't #1 anymore, and are moving on to lesser-used browsers where they can feel special because they really *are* the only users there. And Firefox is still for the rest of the people who used it, and can continue making a proper browser instead of just one where some loud people try to act like it's only value is the add-ons. Let Pale Moon be that browser instead. Firefox is for everyone, not just you.
The underlying problem? Try number 2. Downloading a list and warning users of contacting any site on that list may be a good idea. But that should not be a browser function, it should be an operating system function. There should be a warning any time a computer tries to connect to an unsafe site, for any reason, not just because of browsing.
The Slashdot summary and the stories linked in the summary don't mention that Mozilla is apparently merely copying the Google Chrome browser: Manage warnings about unsafe sites.
My initial reaction was incorrect partly because of poor communication. I didn't understand what was being reported.
So this is going to be like all the "...known to the state of California to cause cancer and birth defects." warnings which are present of every hotel, store, and most products sold in California. While warning about data breaches may be a good sounding idea, in practice this will turn into "this is a brand new company" indicator, i.e. "no warning about data breach means they are brand new to the internet"
A better idea would be to provide details about time, size and handling of every known breach (how quick were customers notified, what remedy was offered, etc).
Yes, you literally "trust" them blindly! Because you know nothing about them, an if you believe you do, you are deluding yourself.
That is not trust. That is just ignorance due to laziness!
Trust is a thing of human interaction! You know... that concept that's considered outdated by most Americans (like Damore) and abused to serve the opposite by the rest of the Americans (SJWs): Social behavior!
(Exceptions show the rule.)
I trust people based on how much I know them! Duh!
The fact that you believe that is the same idea, proves you understood nothing.
I trust MY CA. And ONLY MY. In case you are such a swarm entity that you understand "me" to mean "my group/company/whatever: No. ME = this body, this brain, and not even things others say to me!
And if you had any clue about the insides of TLS, you would never ever say that TLS "is" trustworthy. It is a huge mess on the inside, with too many bad decisions to even be funny.
I use one-time pads from a high-quality randomness source wherever I can, btw. And since I only trust actual people that I actually met, everyone of them gets a nice pad to use to communicate with me. (Using my own software solution that works on Linux/BSD/..., AOSP, and will never exist for anything Apple/Microsoft/Google/Amazon/Facebook/...)