1496845 - delay between Monitor doorhanger and presence in breach data

Status: RESOLVED FIXED

(Firefox :: Firefox Monitor, defect)

Description

[Rosanne Scholl]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:64.0) Gecko/20100101 Firefox/64.0

Steps to reproduce:

-a new breach is uploaded to haveibeenpwned
-I go to the breached website right away after learning of the breach from the news
-I see the Monitor doorhanger and click on it
-I enter my email address


Actual results:

Monitor tells me that my email address is not part of the breach, but this is because the server has not yet updated the list of emails.


Expected results:

The doorhanger should not appear until Monitor is able to give me valid results.

Comment 1

[:Gijs (he/him)]

Nihanth, can you ensure the right people see this?

And does this really need to be treated as a security bug, rather than moco-confidential?

Comment 2

[Daniel Veditz [:dveditz]]

This is not a security vulnerability that needs to be hidden -- it's not an attack vector. There is a security aspect in that users could be misled into thinking they are safer than they are, but in that case they're actually safer if they know we're broken in this way. I don't think this needs to be confidential at all, but I'll leave that up to the reporter.

Comment 3

[(inactive) Nihanth Subramanya [:nhnt11]]

I don't think this needs to be confidential either. As for the bug - the doorhanger should not be appearing at all - we rolled it back pending a few last-minute issues. On the other hand, the issue that is being described is valid, but should be taken care of when the doorhanger is released - we are going to be using Remote Settings to host the data that the doorhanger uses and we will be able to control updates to this data.

Comment 4

[(inactive) Nihanth Subramanya [:nhnt11]]

I think our Remote Settings implementation is now mature enough to close this bug.

Comment 5

[Rosanne Scholl]

Thank you Nihanth!