11–20 of 61 posts
Cached: http://webcache.googleusercontent.com/search?q=cache:http://... The "news" part of this is that the extension allegedly reports all the URLs you've visited to amazon, including https ones, plus some reporting of site contents to alexa.
Can anyone fathom a potentially benign reason Amazon might do this?
Read the article. The configuration from amazon is only set up to gather https data on amazon sites. Because the configuration was sent over http, he used a man in the middle attack to change it to a wildcard, and gather all https data. Amazon wasn't being evil, just incompetent. Never attribute to malice what can adequately be explained by stupidity...
This behavior looks premeditated to me.
Can anyone fathom a potentially benign reason Amazon might do this?
Read the article. The configuration from amazon is only set up to gather https data on amazon sites. Because the configuration was sent over http, he used a man in the middle attack to change it to a wildcard, and gather all https data. Amazon wasn't being evil, just incompetent. Never attribute to malice what can adequately be explained by stupidity...
It's pretty clear they "might do this" so they can data-mine your browsing activity, which is now associated with your account, and serve you more targeted ads and product recommendations. So I guess we have to extend your catch-phrase with "...and never attribute to stupidity what can be adequately explained by greed."
This sort of abusive, insecure extension poisons the well for all extension developers. Now, I wish to submit a couple of feature requests to the Chrome team. 1) I wish there was a way by which an extension could declare its access patterns in much more fine-grained manner (kinda like CORS headers). Then I can prove to my users that my extension cannot do the sort of ugly crap that Amazon is doing. 2) Second is an AP…
I keep them mostly disabled - just can't fathom why a simple extension (e.g. to pretty print JSON) seems to need the access levels on the install warnings.
This sort of abusive, insecure extension poisons the well for all extension developers. Now, I wish to submit a couple of feature requests to the Chrome team. 1) I wish there was a way by which an extension could declare its access patterns in much more fine-grained manner (kinda like CORS headers). Then I can prove to my users that my extension cannot do the sort of ugly crap that Amazon is doing. 2) Second is an AP…
The cert I use for my backend doesn't need to be part of the existing trusted CA infrastructure if I control the clients.
This sort of abusive, insecure extension poisons the well for all extension developers. Now, I wish to submit a couple of feature requests to the Chrome team. 1) I wish there was a way by which an extension could declare its access patterns in much more fine-grained manner (kinda like CORS headers). Then I can prove to my users that my extension cannot do the sort of ugly crap that Amazon is doing. 2) Second is an AP…
A way for users to restrict some permissions of an app would be good, but a UX/support problem when they disable something that breaks core functionality.