• IMAP mailboxes can be shared between users: https://doc.dovecot.org/2.3/configuration_manual/shared_mailboxes/shared_mailboxes/
• A contact email address could feed into an issue tracker / ticket type system.

Ok, it’s beginning to look like bad UI design on accounts.firefox.com:

If I click sign in at monitor.mozilla.org, it redirects me to an oauth process hosted on accounts.firefox.com which prompts me for my password then sends me back to monitor.mozilla.org.
The settings page at accounts.firefox.com then lists Mozilla Monitor under “Connected Services - Everything you are using and signed into” along with all my browser/device instances. But it doesn’t disappear when signed out from monitor.mozilla.org in the same way that a browser instance disappears when signed out from sync browser-side.

I’m supposing that list does not indicate what has access to sync data, which as far as I understood uses its own strong private keys browser-side which are never shared with the servers.

I’ve seen no documentation that Mozilla Monitor works by accessing one’s sync data.

The interface suggests that it only monitors email addresses manually added on monitor.mozilla.org’s UI.

Yes, I was aware of that at the time, and I probably assumed that my browser would be hashing each piece of data (e.g. each email address or username) before sending it to Mozilla Monitor or haveibeenpwned.

What concerns me is Mozilla Monitor appearing in the list of devices/browsers synced, each of which is implied to have cleartext access to all the data I decide to sync (bookmarks/history/tabs in my case, logins+passwords and more for many other people).

Most mass-marketed VPN services (the type marketed for accessing the internet) allow you to VPN into their private subnet where the thing you can access is their gateway router (which you use in place of your home gateway router/modem for connecting to the internet). You don’t need a VPN service to use VPN software between two points you control.

ublock origin does not have this disclaimer. It works well and is widely trusted.

If you’re using Mozilla’s level of endorsement as a metric, note this prominent disclaimer on the addon’s page:

⚠️ This add-on is not actively monitored for security by Mozilla. Make sure you trust it before installing.

Cryptpad:

• Full-on google docs / office365 / libreoffice type replacement with collaboration.
• E2EE
• The complexity means it doesn’t work well on mobile, takes a while to load on a slow connection, more frequent bugs. (3.5 MiB page transfer)
• Self-hosting is complicated.

Etherpad:

• A competent collaborative rich-text editor. Doesn’t do spreadsheets or presentations or […].
• Not E2EE (you need to trust that the server a bit more).
• Lightweight, works on slower connections, works alright on mobile. (1.7 MiB page transfer)
• Self-hosting quite simple.

PrivateBin:

• Super-simple plain-text/markdown pastebin. No editing possible once saved.
• E2EE
• Very small. Works fine on slow connections and mobile. (0.2 MiB page transfer)
• Self-hosting very simple.