The mechanics behind the v2 API (using k-anonymity with hashes [1]) are pretty interesting too. Troy has clearly put a lot of thought and time into what started as a pet project a few years ago and should be infinitely commended!
[0] https://blog.1password.com/finding-pwned-passwords-with-1pas...
[1] https://www.troyhunt.com/ive-just-launched-pwned-passwords-v...
I would be very concerned if my credentials are being shared in _any_ form with 3rd parties without my explicit permissions.
I hope this firefox feature is disabled by default.
[0] https://app-updates.agilebits.com/product_history/B5X [1] https://support.1password.com/kb/201907/
Just to clear this up: The code for this is actually way simpler and sends no data to either Mozilla nor HIBP. To prevent Firefox from sending data update pings to HIBP, Firefox Monitor maintains a copy of publicly available HIBP breaches and their metadata [1] in the Firefox "Remote Settings" service. [2]
Using that data, Firefox simply checks for saved logins for breached sites where the saved password is older than the breach. [3]
[1] https://haveibeenpwned.com/api/v2/breaches [2] https://wiki.mozilla.org/Firefox/RemoteSettings [3] https://hg.mozilla.org/mozilla-central/file/6484c07ff8364991...
"Firefox downloads a list of breached domain names and the date they were breached, and merely checks if you have any stored logins on any breached domains that are older then the breach date."