61–70 of 84 posts
Here is the blog entry of the Journalist Mike Kuketz, explaining in detail how he uncovered the fraud, unfortunately only in German. This includes samples of the questionable GET and POST Requests, as well as a link to a commit to the WOT sources on GitHub, which introduced the necessary changes ... https://www.kuketz-blog.de/wot-addon-wie-ein-browser-addon-s... The commit referenced in the blog: https://github.com/m…
Web of Trust is a browser extension that claims 140 million installs. The marketing language on the home page [1] is all about how the extension will help users decide which websites to trust. Their privacy statement [2] includes a section that describes "Browsing usage, including visited web pages, clickstream data or web address accessed;" as one of the categories of "non-personal information" that they may disclos…
Do you know what would be a great way to prevent this? Every data send by an extension should be user viewable. Here's the json file (or maybe something better) that we are posting, press Agree to send it
Earlier quoted context omitted.
And by the way, he also suggests in his blog post that Ghostery and Adblock Plus might as well sell browser histories as WOT does. There might be even more.
Ghostery allows you to OPT IN to sending your browsing data [1], which may be sold as part of services offered by their parent company to improve ad ROI for their customers. They also tell you that they're collecting the request data [2]. I think knowingly sharing your data (with a positive affirmation) is significantly different than having your data collected and sold without your knowledge [1] http://imgur.com/a/u…
The problem is that the data is not anonymized enough. The question is, if this is actually possible.
Here is the blog entry of the Journalist Mike Kuketz, explaining in detail how he uncovered the fraud, unfortunately only in German. This includes samples of the questionable GET and POST Requests, as well as a link to a commit to the WOT sources on GitHub, which introduced the necessary changes ... https://www.kuketz-blog.de/wot-addon-wie-ein-browser-addon-s... The commit referenced in the blog: https://github.com/m…
And by the way, he also suggests in his blog post that Ghostery and Adblock Plus might as well sell browser histories as WOT does. There might be even more.
Regarding AdBlock Plus he is complaining about the Acceptable Ads "feature", not that ABP is collecting and/or selling user data
It is a shame that Mozilla did not explain why they removed the addon on the addon page, instead we just find a boring 404 page: https://addons.mozilla.org/en-US/firefox/addon/wot-safe-brow... They could have taken the opportunity to show that they care about user privacy and denounce WoT at the same time
I am confident they will release a public statement and maybe even an actual post mortem for the tech crowd
Earlier quoted context omitted.
Reminds me of the old saying. "When the service is free the product is you."
Lateley there's a trend to dismiss the above saying (i.e. if it's free you are the product) in a casual manner. Reality isn't influenced by such dismissals or wishful thinking however. If a company's financial interests aren't aligned with the general interests of its customers, then it will trample over the interests of its customers. Google, Facebook, any company that's selling advertising are not only not your fri…
Free Software is free, and you aren't the product when you use it. In most cases its the only software that actually puts the user first.
Saying "If it's free, you are the product" tells people that the only way to get good software is to pay money for it. When in reality lots of payed software harvests your data just as much.
Earlier quoted context omitted.
This begs the question: Where do you draw the line between "data logging" and submitting the URL (or domain, I'm not certain on what level WoT would normally operate) to a server in order to get its reputation? In the end, you can't be certain what the backend does with the data just by looking at the extension code. If you go too far with a rule like that, you'll likely block a lot of legitimate and useful extension…
Currently, facing this abuse, I'd completely forbid data transfer from an extension to a server by default. Then add exceptions: If the transfer is necessary for the legitimate function of the extension (note: It is not for stuff like adblocker, where the lists are already cached locally), allow it under special control as long as the data sent out is anonymized as much as reasonable. URLs for example should be hashe…
That doesn't help at all. If the server has a database it's going to match this hash too, then it knows what URL corresponds to the hash.
I wanted to say: And Google did not removed it. But actually it is also gone in Google extension store. Google also seriously needs to think about security in their Chrome extension store. I've seen more than once ads injected by extensions by the auto update (no real security there). Maybe I've been also tracked in the past. Google needs to actively monitor all extensions for ad injection and tracking code (where ar…
For every site you visit, there is a POST to
https://api2.poperblocker.com/view/update
us=576
ver=1.0
sver=1
nid=chrome
h=e[...]6
tid=1478271585985
u=https%3A%2F%2Fthehftguy.wordpress.com%2F2016%2F11%2F01%2Fdocker-in-production-an-history-of-failure%2F&p=https%3A%2F%2Fnews.ycombinator.com%2F
rd=https%3A%2F%2Fnews.ycombinator.com%2F
ch=2
The privacy policy of the extension used to be complete nonsense, a copy-pasta of the text found on the front page of (probably unrelated) site `whatarecookies.com`.
Looks like they changed it though[2], it is now a large image of pure-text HTML[3], which appears to be borrowed a lot from (coincidence!) WOT's own Privacy Policy's page.[4] I will assume using an image may be to purposefully make it more difficult to find out the copy-pasta.
The review I had left a few weeks ago for the extension -- in which I informed of the above -- seems to be gone.
[1] https://chrome.google.com/webstore/detail/poper-blocker/bkkb...
[2] http://www.poperblocker.com/privacy.html
Earlier quoted context omitted.
Currently, facing this abuse, I'd completely forbid data transfer from an extension to a server by default. Then add exceptions: If the transfer is necessary for the legitimate function of the extension (note: It is not for stuff like adblocker, where the lists are already cached locally), allow it under special control as long as the data sent out is anonymized as much as reasonable. URLs for example should be hashe…
> URLs for example should be hashed before going out. That doesn't help at all. If the server has a database it's going to match this hash too, then it knows what URL corresponds to the hash.
Earlier quoted context omitted.
Do you know what would be a great way to prevent this? Every data send by an extension should be user viewable. Here's the json file (or maybe something better) that we are posting, press Agree to send it
They would just start obfuscating the data (with ciphers, word replacements, encoding, minification, etc.) They'd then claim it was for your security/privacy/protection. You know, like how Microsoft encrypts your Windows 10 usage data it sends them. At least you could use the presence of such obfuscation as a sign there's probably something bad afoot. Presuming only a tiny number of extensions try to encode the data…
So, that "if you have nothing to hide..." argument, basically?
