Live data from Hacker News

8M users' AI conversations sold for profit by "privacy" extensions

koi.ai

11–20 of 261 posts

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#11
post #9

Google needs to act on removing these extensions/doing more thorough code reviews. Reputability is everything, and they can be actually valuable (e.g. LastPass, my own extension Ward) There has to be a better system. Maybe a public extension safety directory?

Google is doing code review on extensions?

I’m not sure, but whenever I cut a new release I upload my extension code and it goes through a review period before they publish.

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#12
post #8

Google needs to act on removing these extensions/doing more thorough code reviews. Reputability is everything, and they can be actually valuable (e.g. LastPass, my own extension Ward) There has to be a better system. Maybe a public extension safety directory?

Do you think Google wants to have the extensions system, given that this is how people block ads?

adblockers on chromium-based browsers were severely crippled by manifest V3. they're fine with extenisons (and apparently malware) as long as users can't effectively block their tracking/ads.

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#14
post #8

Google needs to act on removing these extensions/doing more thorough code reviews. Reputability is everything, and they can be actually valuable (e.g. LastPass, my own extension Ward) There has to be a better system. Maybe a public extension safety directory?

Do you think Google wants to have the extensions system, given that this is how people block ads?

I wouldn’t be surprised if it goes away - it’s very “old Google”. We’re moving more towards walled gardens.

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#15

Oh, a free of cost vpn extension that requires access to all sites and data is somehow spyware, color me surprised. With those extensions the user's data and internet are the product, most if not all are also selling residential IP access for scrapers, bots, etc. Good thing Google is protecting users by taking down such harmful extensions as ublock origin instead.

ublock requires access to all sites and data. Maybe they are trustworthy but who really knows?

Let's say we don't trust ublock. At the very least it is still blocking ad networks which do reduce internet performance and are vectors of exploitation, so it is still adding value whether you trust it or not.

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#16
post #7

I treat extensions like they're all capable of privileged local code execution. My selection is very vetted and very small.

The only extensions I have installed are dark reader and ublock origin. Would be nice if I could disable auto updating for them somehow and run local pinned versions...

Get the source code and manually pack your own unsigned web-ext’s.

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#17
I am surprised because google review team rejects half of my extensions and apps.

Sometimes things don't make sense to me, like how "Uber Driver app access background location and there is no way to change that from settings" - https://developer.apple.com/forums/thread/783227

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#18
The company behind this appears to be "real" and incorporated in Delaware.

> Urban Cyber Security INC

https://opencorporates.com/companies/us_de/5136044

https://www.urbancybersec.com/about-us/

I found two addresses:

> 1007 North Orange Street 4th floor Wilmington, DE 19801 US

> 510 5th Ave 3rd floor New York, NY 10036 United States

and even a phone number: +1 917-690-8380

https://www.manhattan-nyc.com/businesses/urban-cyber-securit...

They look really legitimate on the outside, to the point that there's a fair chance they're not aware what their extension is doing. Possibly they're "victim" of this as well.

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#19
post #15

Earlier quoted context omitted.

ublock requires access to all sites and data. Maybe they are trustworthy but who really knows?

Let's say we don't trust ublock. At the very least it is still blocking ad networks which do reduce internet performance and are vectors of exploitation, so it is still adding value whether you trust it or not.

Under the hypothetical that we don't trust ublock, it would be foolish to grant it full access to all data on all websites. It would not be adding value.

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#20
post #7

I treat extensions like they're all capable of privileged local code execution. My selection is very vetted and very small.

The only extensions I have installed are dark reader and ublock origin. Would be nice if I could disable auto updating for them somehow and run local pinned versions...

Add-ons Manager -> (click the add-on in question) -> change "Allow automatic updates" to "Off"

(for firefox/derivatives anyways...)

Post reply on HN