Hacker News Reader

Comment by GordonS | Hacker News Reader

I'd love to see a non-profit organisation like Mozilla pick this up, but that's obviously going to mean a lot less money going to Troy.

OTOH, it's kind of difficult to begrudge Troy gaining financially from HIBP, since he's spent years building it up and has helped increase security awareness for so many people.

View on HN

I feel like Mozilla is well-positioned to meet Troy's requirements. It won't be cheap for them, but I think their branding is much more in line with his goals than the large FAANG tech companies.

It makes sense to tie it into the Firefox Account password manager too. Mozilla could leverage Troy's close connections with industry to have Firefox as the recommended secure & open-source option for enterprise clients.

Something that hasn't been touched on as much is the limitations that come with contracts for large commercial companies. Side projects are often expressly forbidden. Yes, Google with give you 20% time to work on your own ideas, but you can't then upload it to your personal website and call it your own - it becomes company property and may never see the light of day. I imagine that Mozilla are more open-minded in that respect. They also have plenty of experience with remote teams, which would work well for his family/travel tradeoffs.

Please, Mozilla - if this opportunity is offered to you, take it.

Troy works with Microsoft currently, so I doubt it would work with Mozilla as MS have Edge

Microsoft Regional Director don't work for Microsoft. If that's what you are referring to. They are recognized by Microsoft based on one's expertise & skills.

Ah yes, my mistake.

No, this shouldn't be used to segregate browsers. You just end up cutting a tonne of people of from the benefit unless the subscribe to the "we're sending all your DNS calls to third-parties and installing plugins you can't remove to advertise stuff you don't want"-browser.

Given Mozilla's current direction in terms of looking for more revenue streams, it might be quite well timed - if it can be commercialized successfully on the B2B end, that is.

https://www.translatetheweb.com/?from=&to=en&a=https://t3n.d...

Mozilla also recently launched their own version of HIBP that just gets the data from HIBP and passes it to their users: https://monitor.firefox.com/

Though just realised, they're not that upfront about giving HIBP credit - If I were Troy this would peeve me a bit.

It's not massively advertised on the homepage (though in some respects, I think outside of infosec circles "Firefox Monitor" probably sounds more professional/neutral than "Have I been pwned").

I think they discussed HIBP in the launch announcement: https://blog.mozilla.org/security/2018/11/14/when-does-firef...

It's also in the FAQ: https://support.mozilla.org/en-US/kb/firefox-monitor-faq

Just tried it, they specifically write "Breach data provided by Have I Been Pwned" at the end of results.

I thought the same when I initially was prompted about Firefox monitor at the bottom of Firefox's new tab page.

Was a little peeved at what seemed like a copy, but I have now realised it is just building on top of Troy's work [1] which is even better because of Firefox's larger reach.

They don't have to have a blinking marque text at the top attributing it to Have I Been Pwned. But they could have mentioned it on the front page somewhere that HIBP is one of their main sources. I trust HIBP, therefore, more value to Firefox Monitor had I known that link.

[1] https://www.troyhunt.com/were-baking-have-i-been-pwned-into-...

> I trust HIBP, therefore, more value to Firefox Monitor had I known that link.

If you trust HiBP, you don't really need Firefox Monitor. It was created specifically to reach people that HiBP could not reach.

HIBP only works because of trust in Troy Hunt, few organisations have that.

Maybe an organisation not involved in advertising at any level.

It's definitely trust in Troy, and the level of transparency he's maintained, that have led to HIBP being successful.

But I, personally, would now trust Mozilla with this, were there to take ownership.

I was just thinking, the only ones I can imagine taking ownership would be one of the "big internet foundations" that have earned their trust: Mozilla, the Internet Archive, Wikimedia, or the EFF. Of those, Mozilla and the EFF are the only ones that make real sense. I hope it's one of them, and not fucking Norton AntiVirus or whatever.

I agree about EFF - I'd be happy with Mozilla or EFF.

Could they leverage some sort of Troy partnership / oversight?

"Troy Approved!"

Mozilla is a good group, they've had missteps but I find them trustworthy and the combination would be pretty trustworthy IMO.

A Mozilla acquisition of HIBP could look alot like Mozilla buying HIBP from them, and then bringing Troy on board for a period of time as an evangelist, and the nature of being an open source, community focused org means that Troy could retain his ties to Mozilla as long as he wants to, as a staff member or volunteer.

I don't know how much has changed since I left Mozilla, but there were, and probably still are, a number of former employees and volunteer contributors that had a great degree of influence and input on various projects.

Heck, Troy might even be a good potential addition to the Mozilla board of directors at some point in the future.

It calls to mind the trust in Jon Postel, who managed DNS through IANA for about 10 years basically alone until his death in 1998 and IANA's subsequent transfer to ICANN (which had just been founded).

Since Troy will still be involved, hopefully he can steer things in a direction that benefits everyone - or at least warn the public otherwise.

I also think that HIBP is something of a "public good" and would be best for some sort of non-profit or another. Mozilla is possibly the best currently aligned, of course.

Another weird thought is that it's the sort of "baseline infrastructure" that should be "governmental" to the internet. Unfortunately the closest I can think to an existing model for that is ICANN and that may not be something to emulate.

Reply on news.ycombinator.com