Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

8M users' AI conversations sold for profit by "privacy" extensions

koi.ai

Post reply on HN
Print view View original

161–170 of 261 posts

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#161

Post by Agraillo »

hexagonwin wrote: post #108

lol, this Urban VPN addon was available for Firefox too but got removed at some point. https://old.reddit.com/r/firefox/comments/1jb4ura/what_happe...

Thanks, the last fetched page on archive.org is from 2025-01-26 [1], removed after this date and before 2025-02-13. 155,477 users at the moment, 1 star reviews were mostly about not working. It's interesting that the developers didn't care to remove the button directing to the ff add-on page at least several months after the removal. Maybe was some kind of PR compromise, they probably thought that listing it with linking to a broken page was better than not listing at all.

A review page [2] mentions that this add-on is a peer-to-peer vpn, not having its own dedicated servers that already makes it suspicious.

[1] https://web.archive.org/web/20250126133131/https://addons.mo...

[2] https://www.vpnmentor.com/reviews/urban-vpn/

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#162

Post by johncolanduoni »

g947o wrote: post #89
adrr wrote: post #82

Earlier quoted context omitted.

Its the reason why they found it because the code was in extension. Before manifest v3, extensions could just load external scripts and there's no way you could tell what they were actually doing.

> extensions could just load external scripts and there's no way you could tell what they were actually doing. I do think security researchers would be able to figure out what scripts are downloaded and run. Regardless, none of this seems to matter to end users whether the script is in the extension or external.

Even if the extension isn’t malicious, it creates a new attack vector that can affect users. If whatever URL the script is remotely loaded from is compromised, now all users of that extension are vulnerable.

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#163

Post by moi2388 »

creatonez wrote: post #140
adrr wrote: post #82

Earlier quoted context omitted.

Its the reason why they found it because the code was in extension. Before manifest v3, extensions could just load external scripts and there's no way you could tell what they were actually doing.

Wait, does that mean Manifest v3 is so neutered that it can't load a ` ` tag into the page if an extension needed to? If so, I feel like something that limited is hardly even a browser extension interface in the traditional sense.

That is correct. You can not inject external scripts. You can fetch from a remote and inject through the content script though, but the content and service worker code is known at review time.

So you can still do everything you could before, but it’s not as hidden anymore

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#164

Post by akimbostrawman »

mat_b wrote: post #47

I don't understand why so many people are using / trusting VPNs "Let us handle all your internet traffic.. you can trust us.. we're free!" No thank you.

ISPs are so heavily regulated that the will give any federal or government agency free access to future and past internet connection information that are directly tied to your real identity.

Meanwhile reputable VPN provider like mullvad offer there service without KYC and leave feds empty handed when they knock on there doors.

https://mullvad.net/en/blog/mullvad-vpn-was-subject-to-a-sea...

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#165

Post by pxtail »

dgellow wrote: post #153

Do we know for how much that type of content sells? Not that I'm interested in entering the market, but the economics of that kind of thing are always fascinating. How much are buyers willing to pay for AI conversations? I would expect the value to be pretty low

Let's assume that people are discussing medical conditions in these conversations - I think that insurance companies would be pretty interested to get this kind of data in their hands.

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#167

Post by silverwind »

Joker_vD wrote: post #139
Dylan16807 wrote: post #90

Earlier quoted context omitted.

I'd be significantly more suspicious by default of ISPs that charge no money. > That's why TLS exists, after all. That protects you if you're using standard methods to connect. Installed software gets to bypass it.

And that's why I, personally, rent a VPS, run "ssh -D 9010 myvps" in a background, and selectively point my browser at it via proxy.pac (other apps get socksified as needed; although some stubbornly resist it, sigh ). But it's cumbersome.

You should run VPN on your gateway instead.

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#169

Post by skywhopper »

murillians wrote: post #156

“ A few weeks ago, I was wrestling with a major life decision. Like I've grown used to doing, I opened Claude” Is this where we’re at with AI?

A certain type of person loves nothing more than to spill their guts to anyone who will listen. They don’t see their conversational partners as other equally aware entities—they are just a sounding board for whatever is in this person's head. So LLMs are incredibly appealing to these folks. LLMs never get tired or zone out or make snarky responses. Add in chatbots’ obsequious enabling, and these folks are instantly hooked.
Post reply on HN