[RFC] Behavior on unverified breaches

[riking]

What should the behavior of this extension be when you visit a site with an unverified breach?

Here's a set of options that seems to span the spectrum of possible behavior:

1. Don't show any notification - if it turns out to be fake, we worried a bunch of people for no reason
2. Only show a notification if some criteria is met - e.g. user is frequent visitor to the site? logged in
3. Save that you visited the site, and give a notification later if the breach is verified as correct - much less invasive, tracked data is very small
4. Give a notification with muted styling and wording ("We're not sure yet, but…")
5. Full speed ahead, tiny or no indication that the breach is marked in HIBP as unverified

[nhnt11]

This is a good point to keep in mind. I'll keep this issue open as a reminder as we iterate on the UX.

[groovecoder]

We are filtering unverified breaches now.