当サイトはユーザー体験を改善するためのメンテナンスを実施中に機能が制限される予定です。記事を読んでもあなたの問題が解決せず質問をしたい場合は、Twitter の @FirefoxSupport、Reddit の /r/firefox で、サポートコミュニティが皆さんを助けようと待機しています。

Mozilla サポートの検索

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

詳しく学ぶ

このスレッドはアーカイブに保管されました。 必要であれば新たに質問してください。

How does Lockwise know same password I use website breached?

  • 3 件の返信
  • 1 人がこの問題に困っています
  • 27 回表示
  • 最後の返信者: Wesley Branton

more options

Where does Firefox store this encrypted list of breached passwords? I get nervous when I read this paragraph below. I stay away of storing anything on the cloud, only on my computer do I want passwords stored. Actually, I have Lockwise disabled for now, only because I have to enter master password everytime I want to view a sites password. I like the old way where I enter master password once and can view all site passwords and better manage. Other than that Lockwise looks fine, thought about reverting to it, but this breached password checking raised a red flag. I know I can turn it off.

Starting in Firefox version 76, Firefox will also check to see if you’ve reused any of these potentially vulnerable passwords with other logins you’ve saved to Lockwise. The browser does this by creating an encrypted list of your breached passwords, then checking it against all saved passwords. Firefox does not keep logs of your plaintext passwords or know them.

Where does Firefox store this encrypted list of breached passwords? I get nervous when I read this paragraph below. I stay away of storing anything on the cloud, only on my computer do I want passwords stored. Actually, I have Lockwise disabled for now, only because I have to enter master password everytime I want to view a sites password. I like the old way where I enter master password once and can view all site passwords and better manage. Other than that Lockwise looks fine, thought about reverting to it, but this breached password checking raised a red flag. I know I can turn it off. Starting in Firefox version 76, Firefox will also check to see if you’ve reused any of these potentially vulnerable passwords with other logins you’ve saved to Lockwise. The browser does this by creating an encrypted list of your breached passwords, then checking it against all saved passwords. Firefox does not keep logs of your plaintext passwords or know them.

この投稿は Jer により に変更されました

すべての返信 (3)

more options

To clarify, Firefox doesn't actually know your password, nor does it send it anywhere in a way that people will be able to read it.

The Firefox Monitor service uses information gathered and shared by a service called Have I Been Pwned (HIBP). That service monitors lists of breached websites and lists that become publicly shared among hackers and other malicious actors. The HIBP service allows Firefox to search a list of hashed information (emails, passwords, etc).

When a computer hashes something, it converts the regular text into a unique collection of characters. Every time you hash the same text, it will produce the same collection of characters. This can be used to compare information without actually seeing what the information is.

For example, when you create an account on a website, that website doesn't store your actual password in their system. Instead, the password is hashed and the hash is what gets saved on the website's server. Then, when you try to log in, the password you enter gets hashed and then that hash is compared to what's stored on the website's server. If the two hashes match, then the password is correct. If not, it means the password is incorrect.

The Firefox Monitor does something similar. It will hash your email address or your password. But for extra security, it doesn't send that entire hash to the HIBP service. Instead it does something called an anonymized range query. That means that Firefox sends only the first 6 characters of the hash to the HIBP service and the service gives Firefox a list of all the hashes that start with the same 6 characters. Firefox then takes that list and compares your hash to see if it matches one on the list.

The technique is described in more detail in the Scanning for breached accounts with k-Anonymity post on the Mozilla Blog from June 2018 when the Firefox Monitor service was introduced.

The Mozilla Monitor - Frequently asked questions document also has some additional information about the Firefox Monitor service.

Getting the notification that your password or email address has been breached or matches a piece of information in a breach poses little security risk because you should change your password if you get this notification anyway. Since the breaches on the HIBP service are already known breaches, that information has already fallen into the wrong hands, so it's not safe to use anymore.

Hopefully I've answered your question and clarified the service for you.

more options

Thanks, that sounds pretty secure. Wonder what hash function they use, some say say MD5 and SHA-1can be reversed- but who really knows. Besides they only use first 6 characters as you stated.

more options

It appears that the HIBP service does indeed use SHA-1. While that is not as secure as other hashing algorithms, you are correct in your assumption that it's not as much of a risk since only the first <strike>6 characters</strike> 5 characters are actually sent. (Apparently it's changed since that blog post was first written. It's only the first 5 characters that are used now)