Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

8M users' AI conversations sold for profit by "privacy" extensions

koi.ai

Post reply on HN
Print view View original

221–230 of 261 posts

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#221

Post by bennydog224 »

bandrami wrote: post #77
bennydog224 wrote: post #5

Google needs to act on removing these extensions/doing more thorough code reviews. Reputability is everything, and they can be actually valuable (e.g. LastPass, my own extension Ward) There has to be a better system. Maybe a public extension safety directory?

Is this even a problem that code review could find? Once they have your conversation data what happens then isn't part of the plug-in.

You're not wrong, but one thing about scammy developers is they tend to be ballsy and not covert. The Koi blog covers all the egregious code specifically for exfilling LLM conversations. This stuff is a walking red flag if it was in a public commit/PR.

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#222

Post by tremon »

jwr wrote: post #214
GeekyBear wrote: post #67

I stick to extensions that Mozilla has manually vetted as part of the Firefox recommended extensions program. > Firefox is committed to helping protect you against third-party software that may inadvertently compromise your data – or worse – breach your privacy with malicious intent. Before an extension receives Recommended status, it undergoes rigorous technical review by staff security experts. https://support.mozi…

The article says the extension has been "manually reviewed" by Google.

...and we all know that Google never does anything "manually", so I'd take that with the appropriate serving of salt.

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#223

Post by johnebgd »

ikekkdcjkfke wrote: post #208
londons_explore wrote: post #207

Earlier quoted context omitted.

For example, the following hidden anywhere in the codebase allows arbitrary code execution even under the most stringent JavaScript security policy (no eval etc): I=c=>c.map?c[0]?c.reduce((a,b)=>a[b=I(b)]||a(b),self):c[1]:c (How it works is an exercise to the reader) The actual code to run can be delivered as an innocuous looking JavaScript array from some server, and potentially only delivered to one high value targ…

And the reason we can’t put execution of non-declared code behind a permission is because one anal developer at chrome thinks that we shouldn’t break existing sites even though no serious site would do this and you could just show a permission popup with triangle exclamation mark

Users have largely been trained to click okay when asked to give permission without thinking.

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#224

Post by SoftTalker »

victorbjorklund wrote: post #126
azinman2 wrote: post #105

Earlier quoted context omitted.

Wow the virtual office concept is so beyond shady. I wonder if there are any legitimate uses of it?

That you don’t need an office if your company works remotely? Kind of overkill with a whole office for a company with 3 people working at it and everyone works remotely.

Some things still require a mailing address. PO Box isn't always acceptable. Do you want it to be one of your 3 people's houses? What if one moves?

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#227

Post by antipaul »

I wouldn't be surprised if this was done by one of those AI companies themselves!

Remember FaceBook x Onavo?

"Facebook used a Virtual Private Network (VPN) application it acquired, called Onavo Protect, as a surveillance tool to monitor user activity on competing apps and websites"

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#228

Post by SoftTalker »

murillians wrote: post #156

“ A few weeks ago, I was wrestling with a major life decision. Like I've grown used to doing, I opened Claude” Is this where we’re at with AI?

It does strike me as pretty crazy, but I'm at the other end of the spectrum, I almost never think about using an AI for anything. I've tried Claude I think, twice (it wasn't very helpful). The only other AI I've ever used are the "AI summaries" that Duck Duck Go sometimes shows at the top of its search results.

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#230

Post by electroly »

cj wrote: post #220
londons_explore wrote: post #207

Earlier quoted context omitted.

For example, the following hidden anywhere in the codebase allows arbitrary code execution even under the most stringent JavaScript security policy (no eval etc): I=c=>c.map?c[0]?c.reduce((a,b)=>a[b=I(b)]||a(b),self):c[1]:c (How it works is an exercise to the reader) The actual code to run can be delivered as an innocuous looking JavaScript array from some server, and potentially only delivered to one high value targ…

Isn’t minified code banned from chrome extensions?

Google allows minified extensions and doesn't require you to provide the original unminified source. I've never provided Google the real source code to my extension and they rubber-stamp every release. The Chrome Web Store is the wild west--you're on your own.

Mozilla allows minification but you're required to provide the original buildable source. Mozilla actually looks at the code and they reject updates all the time.

Post reply on HN