Two months ago, Mozilla introduced a new service called Firefox Monitor that allows users to check whether their email addresses had been exposed as part of a data breach. Now, the company is adding a feature to its Firefox Quantum desktop browser that will alert people whenever they visit a site that has been breached in the last year.
The Firefox Monitor Notifications feature will roll out to users gradually in the next couple of weeks, and Mozilla officials say it’s part of a larger strategy to add more security and privacy features to the browser.
“Specifically, we are adding a notification to our Firefox Quantum browser that alerts desktop users when they visit a site that has had a recently reported data breach. We’re bringing this functionality to Firefox users in recognition of the growing interest in these types of privacy- and security-centric features,” said Nick Nguyen of Mozilla.
The new feature builds on the the Firefox Monitor service that Mozilla established through a partnership with the Have I Been Pwned site. That site serves as a repository for data breach information and allows users to run any of their email addresses against a database of addresses that have been compromised in breaches. The database goes back several years and includes more than 5.5 billion compromised accounts from more than 320 sites. The notifications aren’t meant to be intrusive and users can turn them off if they’re not interested in being notified about breached sites.
“This is an interim approach to bring attention, awareness, and information to our users now, and to start getting their feedback."
“While using the Firefox Quantum browser, when you land on a site that’s been breached, you’ll get a notification. You can click on the alert to visit Firefox Monitor and scan your email to see whether or not you were involved in that data breach. This alert will appear at most once per site and only for data breaches reported in the previous twelve months,” Nguyen said.
Firefox Monitor uses an anonymous search process to help preserve users’ privacy when they’re looking for their email in the database.
“Hash range queries add k-Anonymity to the data that Mozilla exchanges with HIBP. Data with k-Anonymity protects individuals who are the subjects of the data from re-identification while preserving the utility of the data,” Mozilla’s Luke Crouch wrote at the time Firefox Monitor was announced.
Although the Firefox Monitor Notifications feature hasn’t even been enabled for most users, Mozilla already is planning ways to make it more useful for people.
“This is an interim approach to bring attention, awareness, and information to our users now, and to start getting their feedback. Over the longer term, we want to work with our users, partners, and all service operators to develop a more sophisticated alert policy. We will base such a policy on stronger signals of individual user risk, and website mitigations,” Luke Crouch of Mozilla said.