1510543 - Give an option to opt-out of the Firefox Monitor feature

Status: RESOLVED WORKSFORME

(Firefox :: Firefox Monitor, defect)

Description

[Franck (Wip)]

Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:63.0) Gecko/20100101 Firefox/63.0
Build ID: 20181114214635

I have been pushed the Firefox Monitor feature without my consent.
I use Firefox for privacy reasons so I do not want Mozilla or HaveIBeenPwned to monitor/track my navigation.

I can not find easily any technical explanation on how/what data are shared/transmitted by the feature to any first/third parties.

All I could find does not inform me in any convincing way:
  - https://blog.mozilla.org/blog/2018/11/14/firefox-monitor-launches-in-26-languages-and-adds-new-desktop-browser-feature
    (the feature exists)
  - https://blog.mozilla.org/security/2018/06/25/scanning-breached-accounts-k-anonymity
    (AFAIU it's about how the service/web site works not the feature)
  - https://blog.mozilla.org/futurereleases/2018/06/25/testing-firefox-monitor-a-new-security-tool
    (good to know but does not help)
  - https://blog.mozilla.org/security/2018/11/14/when-does-firefox-alert-for-breached-sites
    (alert policy, does not help either)

Note: naming the feature the same as the service/site is not practical to distinguish which does what.

Consequently, I request a way to opt-out of Firefox Monitor, at least through an about:config setting.

Comment 1

[(inactive) Nihanth Subramanya [:nhnt11]]

Franck, you can disable the feature from the doorhanger - there is an option to "Never show Firefox Monitor alerts". Alternatively, you can set extensions.fxmonitor.enabled to false in about:config.

This feature does not track your navigation. A list of breached sites is downloaded and then compared to locally to determine whether to show an alert. No data is being sent anywhere.