Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

8M users' AI conversations sold for profit by "privacy" extensions

koi.ai

Post reply on HN
Print view View original

191–200 of 261 posts

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#191

Post by megous »

j-bos wrote: post #183
GeekyBear wrote: post #67

I stick to extensions that Mozilla has manually vetted as part of the Firefox recommended extensions program. > Firefox is committed to helping protect you against third-party software that may inadvertently compromise your data – or worse – breach your privacy with malicious intent. Before an extension receives Recommended status, it undergoes rigorous technical review by staff security experts. https://support.mozi…

Funny enough the article mentions this extension was manially reviewed: > A "Featured" badge from Google, meaning it had passed manual review and met what Google describes as "a high standard of user experience and design."

I at some point vetted the extensions for myself.

What I saw in Mozilla extensions store was anything from using minified code (what is this? it might have been useful in the late 90's on the web, but it surely is not necessary as part of an extension, that doesn't download its code from anywhere), to just full on data stealing code (reported, and mozilla removed it after 2 weeks or so).

I don't trust the review process one bit if they allow minified code in the store. For the same reason, "manual" review doesn't fill me with any extra warm confidence feeling. I can look at minified code manually myself, but it's just gibberish, and suspicious code is much harder to discern.

Also, I just stopped using third party extensions, except for 2 (violentmonkey, ublock), so I no longer do reviews. I had a script that would extract the XPI into a git repository before update, do a commit and show me a diff.

Friendly extension store for security conscious users would make it easy to review source code of the extension before hitting install or update. This is like the most security sensitive code that exists in the browser.

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#192

Post by haar »

skywhopper wrote: post #169
murillians wrote: post #156

“ A few weeks ago, I was wrestling with a major life decision. Like I've grown used to doing, I opened Claude” Is this where we’re at with AI?

A certain type of person loves nothing more than to spill their guts to anyone who will listen. They don’t see their conversational partners as other equally aware entities—they are just a sounding board for whatever is in this person's head. So LLMs are incredibly appealing to these folks. LLMs never get tired or zone out or make snarky responses. Add in chatbots’ obsequious enabling, and these folks are instantly h…

Do you just mean external vs internal processing/thinking?

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#193

Post by yoan9224 »

This is exactly why we need more transparency in analytics tools. When building products that handle user data, the "free" model almost always means you're the product.

The scary part is these extensions had Google's "Featured" badge. Manual review clearly isn't enough when companies can update code post-approval. We need continuous monitoring, not just one-time vetting.

For anyone building privacy-focused tools: making your data collection transparent and your business model clear upfront is the only way to build trust. Users are getting savvier about this.

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#194

Post by nl »

azinman2 wrote: post #105
ch2026 wrote: post #25

Earlier quoted context omitted.

https://www.manhattanvirtualoffice.com/ The NY address is a virtual office. https://themillspace.com/wilmington/ The DE address is a virtual office plus coworking facility.

Wow the virtual office concept is so beyond shady. I wonder if there are any legitimate uses of it?

Virtual offices have been around forever and aren't really an indication of being shady necessarily.

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#195

Post by donohoe »

uyzstvqs wrote: post #173
qwertox wrote: post #138

Earlier quoted context omitted.

If Google would care at all for their users, they'd tell WhatsApp to not require the use of the Contacts permission only to add names to numbers when you don't share the Contacts with the App. Or they'd tell WhatsApp to allow granting microphone permissions for one single call, instead of requesting permanent microphone permissions. All apps that I know of respect the flow of "Ask every time", all but Meta's app. Goo…

That's all opinionated, and the latter is part of the OS, not WhatsApp. Not liking how an app works does not compare to an app exfiltrating data without your consent.

They are not comparing it to the data issue. The original issue was lead to further conversation. It’s a valid concern and they make a good point.

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#196

Post by sothatsit »

phkahler wrote: post #172

Why is a security researcher using a Free VPN? The standard wisdom is "if its free, you're the product". So you're going to proxy all your sensitive traffic through a free thing? Its not great to trust paid services with your data, nevermind free stuff. Sometimes knowing tech makes us think we're somehow better and can bypass high level wisdom.

They are not. They found it by searching for extensions that had the capability to exfiltrate data.

> We asked Wings, our agentic-AI risk engine, to scan for browser extensions with the capability to read and exfiltrate conversations from AI chat platforms.

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#197

Post by josephg »

qwertox wrote: post #138
umrashrf wrote: post #17

I am surprised because google review team rejects half of my extensions and apps. Sometimes things don't make sense to me, like how "Uber Driver app access background location and there is no way to change that from settings" - https://developer.apple.com/forums/thread/783227

If Google would care at all for their users, they'd tell WhatsApp to not require the use of the Contacts permission only to add names to numbers when you don't share the Contacts with the App. Or they'd tell WhatsApp to allow granting microphone permissions for one single call, instead of requesting permanent microphone permissions. All apps that I know of respect the flow of "Ask every time", all but Meta's app. Goo…

I wish there was another button on those contact permission boxes which would tell the app you've granted permissions. But when they try to read your contacts, send them randomly generated junk. Fake phone numbers. Fake names.

Or even better, mix in some real names and phone numbers but change all the other details. I want data brokers to think I live in 8 different countries. I want my email address to show up for 50 different identities. Good luck sorting that out.

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#199

Post by londons_explore »

GeekyBear wrote: post #67

I stick to extensions that Mozilla has manually vetted as part of the Firefox recommended extensions program. > Firefox is committed to helping protect you against third-party software that may inadvertently compromise your data – or worse – breach your privacy with malicious intent. Before an extension receives Recommended status, it undergoes rigorous technical review by staff security experts. https://support.mozi…

The problem is most codebase are huge - millions of lines when you include all the libraries etc.

Often they're compiled with typescript etc making manual review almost impossible.

And if you demand the developer send in the raw uncompiled stuff you have the difficulty of Google/Mozilla having to figure out how to compile an arbitrary project which could use custom compilers or compilation steps.

Remember that someone malicious wont hide their malicious code in main.ts... it's gonna be deep inside a chain of libraries (which they might control too, or might have vendored).

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#200

Post by nl »

murillians wrote: post #156

“ A few weeks ago, I was wrestling with a major life decision. Like I've grown used to doing, I opened Claude” Is this where we’re at with AI?

If this is surprising to you then your circle is fairly unusual.

For example HBR recently reported the number 1 use for ChatGPT is "Therapy/companionship"

https://archive.is/Y76c5

Post reply on HN