Skip to content

Move login breach fields into meta record and add password reuse detection for breach alerts #7155

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jo wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Move login breach fields into meta record and add password reuse detection for breach alerts #7155

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9afe23c
Move login breach fields into meta record
jo Jan 12, 2026
0fe7fa6
Add password reuse detection for breach alerts
jo Jan 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,10 @@
* Added Android support for eval-jexl functionality through the `NimbusTargetingHelper.evalJexl()` method, enabling JEXL expression evaluation on Android with full targeting context support.
([#7163](https://github.com/mozilla/application-services/pull/7163))

### Logins
- Add password reuse detection for breach alerts: Database schema upgraded to version 4 with new `breachesL` table storing encrypted breached passwords. New APIs `are_potentially_vulnerable_passwords()` (batch check) and `is_potentially_vulnerable_password()` (single check) enable cross-domain password reuse detection.
- Move breach alert fields (`time_of_last_breach`, `time_last_breach_alert_dismissed`) from `LoginFields` to `LoginMeta` to group internally managed fields that are not directly updateable via the `update()` API.

### Ads-Client
* Adds new Kotlin `AdsClientTelemetry.kt` wrapper for Glean callbacks.

Expand Down
Loading