Mozilla has also put protections in place to minimize the risk of the service being misused by the attackers. Protecting the service and users from bad actors

This setup allows Mozilla to keep the plaintext or hashes of sensitive user data from the HIBP service, and the HIBP service to not disclose its entire set of hashes (and therefore to protect breached users from further exposure). The API responds with many suffixes and the list of breaches that include the full value.”įirefox Monitor then goes through the returned objects to find which (if any) prefix and breached account suffix equals the user-submitted hash value, and shows the result to the user. “When a user submits their email address to Firefox Monitor, it hashes the plaintext value and sends the first 6 characters to the HIBP API. This new Firefox feature allows users to check for compromised online accounts while preserving their privacy,” Luke Crouch, a Privacy & Security Engineer at Mozilla, explained earlier this year. “The new Firefox Monitor service will use anonymized range query API endpoints from Have I Been Pwned (HIBP). Protecting users’ privacyįor those worried about sharing their email address with that service, the good news is that Mozilla has your back: it worked with HIBP and Cloudflare to create a method of anonymized data sharing for Firefox Monitor. After a few months of user testing, Mozilla has launched Firefox Monitor, a free online service that allows users to check whether their email address was involved in a publicly known data breach and to sign up to get notified if the account appears in new data breaches.įirefox Monitor works by checking the submitted email address(es) against the database provided by Troy Hunt’s Have I Been Pwned service.

Foxfire email