Ghacks is shadowbanned on HN for some reason. I vouched for this particular story, but it didn't get traction :( https://news.ycombinator.com/item?id=12850214
Could be because of the title: "Your browsing history may have been sold already" It's not remotely comparable to the situation. "WOT addon is banned from browsers after selling users history to the highest bidder."
Please don't use the word "retarded" as a casual adjective. It's a pejorative term historically used for people with intellectual disabilities. Thanks for understanding.
Here is the blog entry of the Journalist Mike Kuketz, explaining in detail how he uncovered the fraud, unfortunately only in German. This includes samples of the questionable GET and POST Requests, as well as a link to a commit to the WOT sources on GitHub, which introduced the necessary changes ... https://www.kuketz-blog.de/wot-addon-wie-ein-browser-addon-s... The commit referenced in the blog: https://github.com/m…
Firefox really needs to start to disable extensions (but enable exceptions) when in private mode. And maybe it is time to completely forbid data logging in browser addons. Then suspicious activity, like the linked commit would have caused, could be detected.
This begs the question: Where do you draw the line between "data logging" and submitting the URL (or domain, I'm not certain on what level WoT would normally operate) to a server in order to get its reputation? In the end, you can't be certain what the backend does with the data just by looking at the extension code. If you go too far with a rule like that, you'll likely block a lot of legitimate and useful extension. If all you ask for is the word of the extension developer that the data won't be used in this fashion, that probably won't change much in practice.
Web of Trust is a browser extension that claims 140 million installs. The marketing language on the home page [1] is all about how the extension will help users decide which websites to trust. Their privacy statement [2] includes a section that describes "Browsing usage, including visited web pages, clickstream data or web address accessed;" as one of the categories of "non-personal information" that they may disclos…
Do you know what would be a great way to prevent this? Every data send by an extension should be user viewable. Here's the json file (or maybe something better) that we are posting, press Agree to send it
You cannot make a technical solution to this. Now every company tries to collect as much information as they can. Only laws can help.
> Every data send by an extension should be user viewable.
You can start Wireshark and get that data. But it would be too complicated for an average Joe.
I wanted to say: And Google did not removed it. But actually it is also gone in Google extension store. Google also seriously needs to think about security in their Chrome extension store. I've seen more than once ads injected by extensions by the auto update (no real security there). Maybe I've been also tracked in the past. Google needs to actively monitor all extensions for ad injection and tracking code (where ar…
There is nothing that can be done. Any moderation can be easily bypassed (for example, obfuscated code, code loaded from external servers etc.). You just should not install software that you don't trust.
For example I don't use any browser extensions because I don't have time to inspect their code after every update.
I wonder why both Google and Mozilla don't write this at the front page of their extension stores?
Web of Trust is a browser extension that claims 140 million installs. The marketing language on the home page [1] is all about how the extension will help users decide which websites to trust. Their privacy statement [2] includes a section that describes "Browsing usage, including visited web pages, clickstream data or web address accessed;" as one of the categories of "non-personal information" that they may disclos…
The info collected is not considered as consented by the user in Germany by the Hamburg commissioner for data protection: "disclosure of personal data, companies need basically a data subject's consent." "an extensive evaluation the data by Web of Trust is therefore under German law "not allowed" https://translate.google.com/translate?sl=auto&tl=en&js=y&pr...
And I think, assuming its the same as many other EU countries, that means active consent, not just implicit (e.g. you used the product so you implicitly consented to the privacy policy)
> Google needs to actively monitor all extensions for ad injection and tracking code (where are their AI experts on that?) All the AI experts in the world won't be able to solve the halting problem. What you're asking for is impossible.
All the AI experts in the world won't be able to solve the problem of people thinking a problem is equivalent to the halting problem. You don't need perfect performance, you only need to stay ahead of most of the attempts. Fighting fraud is similar -- it's not possible to stop 100%, but you can get close, and try to make it easy to minimize/undo the damage done by the false negatives.
You are probably over optimistic about what AI is. AI is not a human-like mind that sits inside a computer and solves any problem you give.
Firefox really needs to start to disable extensions (but enable exceptions) when in private mode. And maybe it is time to completely forbid data logging in browser addons. Then suspicious activity, like the linked commit would have caused, could be detected.
This begs the question: Where do you draw the line between "data logging" and submitting the URL (or domain, I'm not certain on what level WoT would normally operate) to a server in order to get its reputation? In the end, you can't be certain what the backend does with the data just by looking at the extension code. If you go too far with a rule like that, you'll likely block a lot of legitimate and useful extension…
Do you know what would be a great way to prevent this? Every data send by an extension should be user viewable. Here's the json file (or maybe something better) that we are posting, press Agree to send it
No, the only thing that will work is to pummel guilty companies into the ground with fines. But you can bet GooBookSoft will lobby against that like their lives depended on abusing customer data. And they do depend on it.
I do not think collecting data on users is necessary. You still can show ads in search results even if you don't know anything about a user. And you don't need user's browsing history to sell him an airplane ticket.
Firefox really needs to start to disable extensions (but enable exceptions) when in private mode. And maybe it is time to completely forbid data logging in browser addons. Then suspicious activity, like the linked commit would have caused, could be detected.
This begs the question: Where do you draw the line between "data logging" and submitting the URL (or domain, I'm not certain on what level WoT would normally operate) to a server in order to get its reputation? In the end, you can't be certain what the backend does with the data just by looking at the extension code. If you go too far with a rule like that, you'll likely block a lot of legitimate and useful extension…
Currently, facing this abuse, I'd completely forbid data transfer from an extension to a server by default. Then add exceptions: If the transfer is necessary for the legitimate function of the extension (note: It is not for stuff like adblocker, where the lists are already cached locally), allow it under special control as long as the data sent out is anonymized as much as reasonable. URLs for example should be hashed before going out.
This begs the question: Where do you draw the line between "data logging" and submitting the URL (or domain, I'm not certain on what level WoT would normally operate) to a server in order to get its reputation? In the end, you can't be certain what the backend does with the data just by looking at the extension code. If you go too far with a rule like that, you'll likely block a lot of legitimate and useful extension…
The line should be drawn in a court.
Though what happened here is already forbidden. It is just very difficult to use the law against those criminals. That is why the browser makers are in a better position to control this.