Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

8M users' AI conversations sold for profit by "privacy" extensions

koi.ai

Post reply on HN
Print view View original

131–140 of 261 posts

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#131

Post by ozgrakkurt »

charcircuit wrote: post #113
anonym29 wrote: post #26

Earlier quoted context omitted.

you're not using ublock, you're using ublock lite. it cannot do dynamic filtering, script blocking, or url parameter removal, among other limitations.

Why does that matter if he's not seeing ads. A severely crippled adblocker means that you would see ads during regular usage. Additionally, Brave a chromium based browser has adblocking built into the browser itself meaning it is not affected by webextention changes and does not require trusting an additional 3rd party.

Tracking is also very important. Blocking scripts is very useful

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#134

Post by nevon »

pacifika wrote: post #130
dvratil wrote: post #129

Earlier quoted context omitted.

The question is, does Mozilla rigorously review every single update of every featured extension? Or did they just vet it once, and a malicious developer may now introduce data collection or similar "features" though a minor update of the extension and keep enjoying the "recommended" badge by Mozilla?

This is just spreading FUD where an answer could have been provided. > Before an extension receives Recommended status, it undergoes rigorous technical review by staff security experts. https://support.mozilla.org/en-US/kb/recommended-extensions-...

That link doesn't answer the question though. It states that the extension is reviewed before receiving the recommended status. It does not state that updates are reviewed.

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#136

Post by tasuki »

tasuki wrote: post #127

> And then an uncomfortable thought: what if someone was reading all of this? > The thought didn't let go. As a security researcher, I have the tools to answer that question. What huh, no you don't! As a security researcher you should know better!

> Exactly the kind of tool someone installs when they want to protect themselves online.

No. When you want to increase your security, you install fewer tools.

Each tool increases your exposure. Why is the security industry full of people who don't get this?

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#138

Post by qwertox »

umrashrf wrote: post #17

I am surprised because google review team rejects half of my extensions and apps. Sometimes things don't make sense to me, like how "Uber Driver app access background location and there is no way to change that from settings" - https://developer.apple.com/forums/thread/783227

If Google would care at all for their users, they'd tell WhatsApp to not require the use of the Contacts permission only to add names to numbers when you don't share the Contacts with the App.

Or they'd tell WhatsApp to allow granting microphone permissions for one single call, instead of requesting permanent microphone permissions. All apps that I know of respect the flow of "Ask every time", all but Meta's app.

Google just doesn't care.

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#139

Post by Joker_vD »

Dylan16807 wrote: post #90
Joker_vD wrote: post #81

Earlier quoted context omitted.

For the same reason you trust your ISP? It handles all your internet traffic; and depending on where you live, probably has government-mandated back doors, or is willing to cooperate with arbitrary requests from law-enforcement agencies. That's why TLS exists, after all. All Internet traffic is wiretapped.

I'd be significantly more suspicious by default of ISPs that charge no money. > That's why TLS exists, after all. That protects you if you're using standard methods to connect. Installed software gets to bypass it.

And that's why I, personally, rent a VPS, run "ssh -D 9010 myvps" in a background, and selectively point my browser at it via proxy.pac (other apps get socksified as needed; although some stubbornly resist it, sigh).

But it's cumbersome.

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#140

Post by creatonez »

adrr wrote: post #82
wnevets wrote: post #28

I thought manifest v3 was supposed to make chrome extensions secure?

Its the reason why they found it because the code was in extension. Before manifest v3, extensions could just load external scripts and there's no way you could tell what they were actually doing.

Wait, does that mean Manifest v3 is so neutered that it can't load a `` tag into the page if an extension needed to?

If so, I feel like something that limited is hardly even a browser extension interface in the traditional sense.

Post reply on HN