Mozilla stops distribution of WOT addon

Post by singold » Sat, Nov 05, 2016, 2:25 AM UTC

jlgaddis wrote: post #70

byuu wrote: post #59

Earlier quoted context omitted.

They would just start obfuscating the data (with ciphers, word replacements, encoding, minification, etc.) They'd then claim it was for your security/privacy/protection. You know, like how Microsoft encrypts your Windows 10 usage data it sends them. At least you could use the presence of such obfuscation as a sign there's probably something bad afoot. Presuming only a tiny number of extensions try to encode the data…

> ... you could use the presence of such obfuscation as a sign there's probably something bad afoot. So, that "if you have nothing to hide..." argument, basically?

Post by r721 » Sat, Nov 05, 2016, 12:58 PM UTC

admax88q wrote: post #67

onli wrote: post #49

Earlier quoted context omitted.

Currently, facing this abuse, I'd completely forbid data transfer from an extension to a server by default. Then add exceptions: If the transfer is necessary for the legitimate function of the extension (note: It is not for stuff like adblocker, where the lists are already cached locally), allow it under special control as long as the data sent out is anonymized as much as reasonable. URLs for example should be hashe…

> URLs for example should be hashed before going out. That doesn't help at all. If the server has a database it's going to match this hash too, then it knows what URL corresponds to the hash.