Live data from Hacker News

Data exfiltration in Keepa Price Tracker

palant.info

11–20 of 38 posts

Re: Data exfiltration in Keepa Price Tracker

#11
post #9

From the Keepa addon settings: > Allow the add-on to gather Amazon prices to improve our price data I thought it was common knowledge that Keepa uses the addon to gather prices. Though with GDPR it probably needs to be more explicitly said.

There is a difference between gathering prices and loading extra URLs to gather those prices. From that text, I would not assume they are using my computer as a part of a botnet.

Re: Data exfiltration in Keepa Price Tracker

#12
post #8
post #5

I can't quite understand this article and its conclusion. The article says: "[The extension] will collect information about the products you look at and the ones you search for". Yet, two sentences later it says "The company behind the extension fails to comply with its legal obligations. The privacy policy is misleading in claiming that no personal data is being collected." So which personal information is exactly i…

Note : I am the author of the article above. The history of all Amazon products you looked at or searched for is personal data, and it can tell a lot about you. Whether it is also personal data in the legal sense is not something I can say for sure. But it definitely has to be properly covered in the privacy policy, for GDPR compliance at the very least.

But it is not personal data that would identify you (PII). If someone was able to determine who I was based solely on my browsing activity on Amazon, then they've already obtained my personal information.

Re: Data exfiltration in Keepa Price Tracker

#13
post #9

From the Keepa addon settings: > Allow the add-on to gather Amazon prices to improve our price data I thought it was common knowledge that Keepa uses the addon to gather prices. Though with GDPR it probably needs to be more explicitly said.

Note: I am the author of the article above.

Nice, I didn’t find this setting and I explicitly went looking for it. So the settings in the “price history” graph don’t merely apply to the way this graph is shown. Now I need to figure out what this setting is doing. Because I didn’t see any conditions in the code which were tied to this setting.

Re: Data exfiltration in Keepa Price Tracker

#14
post #13
post #9

From the Keepa addon settings: > Allow the add-on to gather Amazon prices to improve our price data I thought it was common knowledge that Keepa uses the addon to gather prices. Though with GDPR it probably needs to be more explicitly said.

Note : I am the author of the article above. Nice, I didn’t find this setting and I explicitly went looking for it. So the settings in the “price history” graph don’t merely apply to the way this graph is shown. Now I need to figure out what this setting is doing. Because I didn’t see any conditions in the code which were tied to this setting.

Found it. This is the optOut_crawl setting and its handling is entirely on the server side. So presumably if this setting is set, the server will no longer send the extension any instructions to scrape Amazon pages in background. Mind you, it still could but it probably won’t.

Scraping data from pages you visit shouldn’t be affected by this.

Re: Data exfiltration in Keepa Price Tracker

#15
post #12
post #8

Earlier quoted context omitted.

Note : I am the author of the article above. The history of all Amazon products you looked at or searched for is personal data, and it can tell a lot about you. Whether it is also personal data in the legal sense is not something I can say for sure. But it definitely has to be properly covered in the privacy policy, for GDPR compliance at the very least.

But it is not personal data that would identify you (PII). If someone was able to determine who I was based solely on my browsing activity on Amazon, then they've already obtained my personal information.

No, it isn’t PII in the legal sense, it doesn’t allow identifying you directly. Which doesn’t mean that it cannot be tied to your identity. Just one example: if you regularly post to social media what you bought online, this information could be correlated with the Keepa data to find out which profile is likely yours and what else you looked at.

But GDPR doesn’t merely require you to disclosure collection of PII, but rather all data collected. There is a good reason for that.

Re: Data exfiltration in Keepa Price Tracker

#16
post #12
post #8

Earlier quoted context omitted.

Note : I am the author of the article above. The history of all Amazon products you looked at or searched for is personal data, and it can tell a lot about you. Whether it is also personal data in the legal sense is not something I can say for sure. But it definitely has to be properly covered in the privacy policy, for GDPR compliance at the very least.

But it is not personal data that would identify you (PII). If someone was able to determine who I was based solely on my browsing activity on Amazon, then they've already obtained my personal information.

PII is not a term that is used in the GDPR. The person you're replying to is correct that your browsing data is likely to count as personal data given that it's linked to an individual.

Re: Data exfiltration in Keepa Price Tracker

#17

Wow, they've built a distributed Amazon listing scraping system – essentially a botnet. As someone who has done a lot of web scraping and had to route around a lot of blocking (we have business contracts to allow scraping, but they don't stop over-eager sysadmins), this feels like a dream come true. But I'd never actually want to use this for scraping and I'm not sure any informed user would agree to use this.

How do you get contracts to allow scraping? What kind of cost are we talking about?

Re: Data exfiltration in Keepa Price Tracker

#19
post #4

And not sure if Amazon would agree to this as it essentially threatens the privacy and integrity of their users. Interestingly, Keepa is also an Amazon Affiliate, so they are in a direct business relationship with Amazon.

They actively warned about Honey Security Issues, but haven't mentioned Keepa at all.

Re: Data exfiltration in Keepa Price Tracker

#20
> Unless of course you don’t consider the information collected here personal.

I don’t. The author even goes out of their way to point out that these requests aren’t generated by the user and so there’s no latent interest information there. I agree that they should cover this behavior in the privacy policy explicitly, but there’s a tone of moral outrage in this piece that seems unearned.

Post reply on HN