Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Amazon Assistant lets Amazon track your every move on the web

palant.info

Post reply on HN
Print view View original

21–30 of 67 posts

Re: Amazon Assistant lets Amazon track your every move on the web

#21

Post by palant »

kevinsundar wrote: post #12
ziddoap wrote: post #11

Earlier quoted context omitted.

Not only did you miss the point of the article, you must have missed where in these very comments the author replies to someone else who just barely skimmed the article. I will copy/paste it for you. "You could also read the article before commenting. It’s one thing when an extension could do something but its code can be inspected to verify that it doesn’t. It’s an entirely different thing if it delegates its privil…

All right upon closer reading you are correct. I seem to have missed the point of the article. There are some good points that the author brings up. However I still think the title could be better. There are lots of things that applications "can" do. I put more trust into random applications that run on my system.

Yes, you put considerable trust into applications running on your system. But I hope that you don’t just install random applications. You probably choose only vendors where you can reasonably assume that they don’t want to accept the backlash of having shipped a malicious application.

Now shipping a malicious application is always a risk. This application release is evidence of misbehavior, should someone choose to analyze it. This risk is almost non-existent with dynamic web applications. It would have to be the one targeted user who analyzes megabytes of code.

To sum up: there is a good reason why websites are sandboxed and don’t get any access to your system.

Note: I am the author of this article.

Re: Amazon Assistant lets Amazon track your every move on the web

#22

Post by palant »

tantalor wrote: post #6
KoftaBob wrote: post #2

"Still, I was astonished to discover that Amazon built the perfect machinery to let them track any Amazon Assistant user or all of them: what they view and for how long, what they search on the web, what accounts they are logged into and more. Amazon could also mess with the web experience at will and for example hijack competitors’ web shops. Amazon Assistant log with a borg eye Image credits: Amazon, nicubunu, Open…

> before finding any evidence for it Did you see the screenshot with the Amazon ad popup obscuring Google ads?

That’s actually legitimate functionality of this extension. :-)

Note: I am the author of this article.

Re: Amazon Assistant lets Amazon track your every move on the web

#23

Post by spideymans »

antattack wrote: post #5

Seems to me that browser extensions need better access control. Why isn't it possible to restrict it to just amazon.com itself, for example?

Browser extensions being enabled for all webpages by default is bad practice for security and privacy. Often the user only wants to use the extension on specific webpages. For example, if I have a video downloader extension, chances are that I only want to use that extension on the page with the specific video I want to download.

Extensions should be disabled by default upon install. If the user wants to use the extension, the user should be able to click on the extension to active it for this specific page for one time only. None of the major browsers are capable of this (so far as I'm aware), so I always have to remember to disable an extension when I'm done using it.

Re: Amazon Assistant lets Amazon track your every move on the web

#24

Post by tantalor »

palant wrote: post #22
tantalor wrote: post #6

Earlier quoted context omitted.

> before finding any evidence for it Did you see the screenshot with the Amazon ad popup obscuring Google ads?

That’s actually legitimate functionality of this extension. :-) Note: I am the author of this article.

Covering up your competitors ads with your own sounds a lot like "mess with the web experience at will and for example hijack competitors’ web shops".

Disclaimer: I work for Google Shopping, but not the ads part :)

Re: Amazon Assistant lets Amazon track your every move on the web

#25

Post by palant »

tantalor wrote: post #24
palant wrote: post #22

Earlier quoted context omitted.

That’s actually legitimate functionality of this extension. :-) Note: I am the author of this article.

Covering up your competitors ads with your own sounds a lot like "mess with the web experience at will and for example hijack competitors’ web shops". Disclaimer: I work for Google Shopping, but not the ads part :)

The whole extension is all about “let’s see when customers go to competition and try to bring them back.” That’s rather shady but it’s exactly the advertised functionality. And I’ve already got the first comment on the blog essentially saying “I don’t care what else they do, this extension gives great suggestions and I love that.” :-)

Re: Amazon Assistant lets Amazon track your every move on the web

#26

Post by TedDoesntTalk »

> Putting these JavaScript files into the extension would have been possible with almost no code changes

The AMO team at Firefox used to outright ban addons with remote script injection. I guess it matters who you are -- like on the Apple App Store, big names just need to pull the right strings or call the right people for a free pass. Rules are not applied equally. The playing field is NOT level.

Re: Amazon Assistant lets Amazon track your every move on the web

#27

Post by cptskippy »

TedDoesntTalk wrote: post #26

> Putting these JavaScript files into the extension would have been possible with almost no code changes The AMO team at Firefox used to outright ban addons with remote script injection. I guess it matters who you are -- like on the Apple App Store, big names just need to pull the right strings or call the right people for a free pass. Rules are not applied equally. The playing field is NOT level.

> Rules are not applied equally. The playing field is NOT level.

That's true, always has been.

> big names just need to pull the right strings or call the right people for a free pass

I'd be curious if that's the case.

For the most part in B2B, "the rules" generally only apply when the risk of a client doesn't out weight the benefit of that client. T&C and Contracts are always negotiable, it's just a matter of if it's worth it to both parties.

Amazon has more street cred than say, me, as a developer. And Amazon has a lot more to lose from their Add-On doing a bunch of evil things that I would if I decided to do evil things with mine. Amazon is big enough to assume liability for both itself and Mozilla if something goes wrong, I can't.

Re: Amazon Assistant lets Amazon track your every move on the web

#29

Post by happyconcepts »

palant wrote: post #19
antattack wrote: post #5

Seems to me that browser extensions need better access control. Why isn't it possible to restrict it to just amazon.com itself, for example?

Most of its functionality is meant to work on other websites. There is probably little reason to install it for amazon.com only. Note: I’m the author of this article.

Which browsers allow users to whitelist specific sites for access by a browser extension?

Or else what is the !#?!% technology hurdle preventing users from making their own lists?

Re: Amazon Assistant lets Amazon track your every move on the web

#30

Post by tgsovlerkhgsel »

drewda wrote: post #13

Wasn't this the shtick of the "toolbar" plugins offered by AOL, Yahoo, and even Google at one point over the years?

The Google toolbar specifically had a privacy settings popup with a big fat red "PLEASE ACTUALLY READ THIS" notice, explaining what it does, and letting you choose between a mode that only worked locally (unless you were making a search or explicitly triggering some other online feature of course) vs. one that sent some data to Google with each visit (with PageRank display being tied to sending the data).

Users weren't pushed to choose one or the other. Both buttons had the same size and color. It was VERY clear that the developers wanted users to make a meaningful, free choice vs. "just click approve".

The benefit for Google was that installing the toolbar made it easier for you to do Google searches, driving usage up.

Edit:

https://searchengineland.com/turning-the-tables-on-the-googl... has a history of these screens, going from the above-mentioned exemplary "please read" screen to an increasing amount of dark patterns.

Post reply on HN