Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firefox add-on with 7m downloads secretly tracks your browsing history

iwtf.net

Post reply on HN
Print view View original

31–40 of 58 posts

Re: Firefox add-on with 7m downloads secretly tracks your browsing history

#31

Post by stevoski »

sudonim wrote: post #25
zerosanity wrote: post #12

A quick fgrep found the code making the requests to their servers: http://pastie.org/1932287 Edit: Further code browsing points to the "rank" feature. They rank all URLs that are http/https and the host isn't "localhost". I'm guessing, but if you turn of ranking in the preferences, it will stop logging your page views.

Why not try and track down Dima Sidorchenko (the guy in the header of the source)? Google thinks the name is Dima Sidorenko and offers up this guy who is a programmer: http://twitter.com/#!/shadow1278 Unless it is Sidorchenko and Dima is a nickname in which case "Dmitriy Sidorchenko" might get better results.

Dima is a standard Russian-language short form for Dmitriy. Like Pete for Peter in English.

The name Sidorchenko sounds Ukrainian.

Re: Firefox add-on with 7m downloads secretly tracks your browsing history

#32

Post by mickeyben »

I don't really see the issue here, isn't all of that stated in the privacy policy of the extension ?

https://addons.mozilla.org/en-US/firefox/addon/video-downloa...

Ant.com collects non-personally-identifying information when you are visiting our site or using our software applications, this infomation made available typically from web browsers and servers. Some of the infomation type is: the Uniform Resource Locator (URL) of the web page from wich you came, the date and the time for each page you view, settings such as browser languages, etc.

Ant.com also collects infomation made public to us that can be considered personally identifyable, such as your internet protocol (IP) address. Ant.com does not use such information to identify its visitors and does not disclose such information.

Re: Firefox add-on with 7m downloads secretly tracks your browsing history

#35

Post by barrkel »

mickeyben wrote: post #32

I don't really see the issue here, isn't all of that stated in the privacy policy of the extension ? https://addons.mozilla.org/en-US/firefox/addon/video-downloa... Ant.com collects non-personally-identifying information when you are visiting our site or using our software applications, this infomation made available typically from web browsers and servers. Some of the infomation type is: the Uniform Resource Locator…

"The web page from wich you came" is just the HTTP "Referer" field; almost every web site in existence collects that as a matter of course. To claim that it covers universal monitoring of all users' web traffic is obscene.

I'm also fairly sure that one can find personally "identifyable" information from URLs that go far beyond mere IP addresses.

Why is ant.com domain info privacy protected anyhow? Seems pretty fishy to me.

Re: Firefox add-on with 7m downloads secretly tracks your browsing history

#36

Post by jokermatt999 »

nikcub wrote: post #9

"This add-on has been preliminarily reviewed by Mozilla." What that entails: "When performing a preliminary review, editors will review the source code for security issues and major policy violations, but will not install the add-on to test functionality in most cases. Preliminary review will be granted unless a security vulnerability or major policy violation is discovered." From: https://addons.mozilla.org/en-US/de…

I'm not sure if this is still the case, but you used to have to make an account and log in to actually install an experimental add on. There was also a clear warning as well.

I definitely agree with setting a time limit, if feasible.

Re: Firefox add-on with 7m downloads secretly tracks your browsing history

#37

Post by barrkel »

user24 wrote: post #33
neanderdog wrote: post #19

do a 'whois' on ant.com. I thought it interesting.

Why, because they have whois privacy? That's not so unusual.

For individuals, e.g. blogs and the like; sure. Something which seems awfully like a company (it looks like they're trying to build a search engine); that's much dodgier to my mind.

Re: Firefox add-on with 7m downloads secretly tracks your browsing history

#39

Post by fligtar »

I'm from the add-ons team at Mozilla.

We've looked into the Ant Video Player and found that it does send information about websites users visit in order to power its ranking feature displayed for each website, and also includes a unique identifier in this communication. While this does not violate our policies, we do require it to be disclosed in the privacy policy and the add-on's description. We have contacted the developer and asked them to correct this.

The developer has been in communication with us and says that they destroy all user-identifiable information from their logs, and that their privacy policy and add-on description will be updated to reflect that. They'll also show a notice about this on their first-run website.

Additionally, the AntRank feature that uses this tracking can be disabled.

Add-ons publicly available in our gallery have been reviewed for security problems, and add-ons that aren't marked as experimental have been fully reviewed for a range of other issues as described in our hosting policies. Because developers set their own privacy policies and can update them any time, it is more difficult for us to review them for compliance with their own rules. We encourage users to always read an add-on's privacy policy if one is provided and to use the Report Abuse link if anything suspicious is noticed.

Re: Firefox add-on with 7m downloads secretly tracks your browsing history

#40

Post by 9999 »

fligtar wrote: post #39

I'm from the add-ons team at Mozilla. We've looked into the Ant Video Player and found that it does send information about websites users visit in order to power its ranking feature displayed for each website, and also includes a unique identifier in this communication. While this does not violate our policies, we do require it to be disclosed in the privacy policy and the add-on's description. We have contacted the…

You should create a policy that completely prohibits this behavior.
Post reply on HN