Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

8M users' AI conversations sold for profit by "privacy" extensions

koi.ai

Post reply on HN
Print view View original

251–260 of 261 posts

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#251

Post by fc417fc802 »

SoftTalker wrote: post #224
victorbjorklund wrote: post #126

Earlier quoted context omitted.

That you don’t need an office if your company works remotely? Kind of overkill with a whole office for a company with 3 people working at it and everyone works remotely.

Some things still require a mailing address. PO Box isn't always acceptable. Do you want it to be one of your 3 people's houses? What if one moves?

Obvious option would be the law firm handling your business license. But can we also take a minute to appreciate the absurdity of a PO box ever being deemed unacceptable? It literally exists for this exact purpose, and there are any number of "PO box except not a PO box" schemes out there due to this issue. It ought to be illegal to treat PO boxes differently IMO.

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#252

Post by londons_explore »

ikekkdcjkfke wrote: post #208
londons_explore wrote: post #207

Earlier quoted context omitted.

For example, the following hidden anywhere in the codebase allows arbitrary code execution even under the most stringent JavaScript security policy (no eval etc): I=c=>c.map?c[0]?c.reduce((a,b)=>a[b=I(b)]||a(b),self):c[1]:c (How it works is an exercise to the reader) The actual code to run can be delivered as an innocuous looking JavaScript array from some server, and potentially only delivered to one high value targ…

And the reason we can’t put execution of non-declared code behind a permission is because one anal developer at chrome thinks that we shouldn’t break existing sites even though no serious site would do this and you could just show a permission popup with triangle exclamation mark

That's what's great about this - it is an interpreter which allows the attacker to do absolutely anything, but no non-declared code is directly run.

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#254

Post by SoftTalker »

fc417fc802 wrote: post #251
SoftTalker wrote: post #224

Earlier quoted context omitted.

Some things still require a mailing address. PO Box isn't always acceptable. Do you want it to be one of your 3 people's houses? What if one moves?

Obvious option would be the law firm handling your business license. But can we also take a minute to appreciate the absurdity of a PO box ever being deemed unacceptable? It literally exists for this exact purpose, and there are any number of "PO box except not a PO box" schemes out there due to this issue. It ought to be illegal to treat PO boxes differently IMO.

Mainly they want an address if they need to serve legal notice to you. You can't deliver that to a PO box, it has to be handed to someone at a physical address.

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#255

Post by miguelspizza »

jackfranklyn wrote: post #141

[flagged]

We actually have this with the permissions API. The issue is everyone just opts for longer approval times and less intrusive UX with manifest level permissions.

I agree though, runtime permissions should be the default

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#256

Post by tetris11 »

Y_Y wrote: post #236
insin wrote: post #181

Earlier quoted context omitted.

You can also, more conveniently, plug an extension's URL into this viewer: https://robwu.nl/crxviewer/

Now I have to trust that viewer doesn't hide the malicious code, nor that my browser does (presumably from an existing untrustworthy extension)

It'd have to be adept at spotting it in all its forms first in order to hide it, which seems expensive for a free viewer

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#257

Post by AlecSchueler »

hxstroy2 wrote: post #245
AlecSchueler wrote: post #243

Earlier quoted context omitted.

The response didn't suggest that it did.

It absolutely did. Seems like you may be an example of exactly what they're discussing, and it looks disadvantageous to me.

Maybe you want to argue your position before going straight to the ad hominem?

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#258

Post by dgellow »

AznHisoka wrote: post #202
dgellow wrote: post #153

Do we know for how much that type of content sells? Not that I'm interested in entering the market, but the economics of that kind of thing are always fascinating. How much are buyers willing to pay for AI conversations? I would expect the value to be pretty low

I doubt its the actual conversations but the aggregated insights that are valuable. Think: is my brand getting mentioned more in AI chats? Are people associating positive or negative feelings towards it? Are more people asking about this topic lately?

Sure, but are they willing to pay and if yes how much. There is a meaningful difference between « could be useful » and « valuable enough that we want to buy »

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#259

Post by dgellow »

pxtail wrote: post #165
dgellow wrote: post #153

Do we know for how much that type of content sells? Not that I'm interested in entering the market, but the economics of that kind of thing are always fascinating. How much are buyers willing to pay for AI conversations? I would expect the value to be pretty low

Let's assume that people are discussing medical conditions in these conversations - I think that insurance companies would be pretty interested to get this kind of data in their hands.

The question isn’t if there is some interesting info in that data but if there are some actual buyers. Lots of interesting data exist, so what’s the value of AI chats?

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#260

Post by hnbad »

dgellow wrote: post #153

Do we know for how much that type of content sells? Not that I'm interested in entering the market, but the economics of that kind of thing are always fascinating. How much are buyers willing to pay for AI conversations? I would expect the value to be pretty low

They say they remove information from the collected data. They aren't very explicit about what information they remove or not. They also seem to be feeding the data they collect right into the affiliated data broker company.

There are two different markets for this kind of complex data:

- Aggregate (demographic) data is useful for targeting, not just regular ads but also in-person outreach or even just identifying areas with a high density of potential customers; you can also use these insights to then categorize people in your own data set (e.g. when onboarding a new user you might cross-reference their details and find out they're high value just based on the "non-personal" data from the data broker that matches their profile).

- Specific (personal) data is useful for companies like insurances to flag you for risks you wouldn't otherwise have to disclose or they might not be able to request disclosure of; because direct transfer of personal data is the most likely kind to run into privacy law issues this is now often obfuscated by feeding it into AI models (i.e. the AI learns to match the collected data at the data broker to the input data it receives from the data broker's customer but there is never an explicit connection between the two data sets so the data broker can claim it is anonymized/aggregated when in practice it's still granular enough for the AI model to be able to categorize you based on seemingly spurious associations).

Note that the fist case overlaps with the second because "aggregate" usually still means that when looking at a new dataset (i.e. data collected from one person) you can say with some confidence which pile of aggregated data it fits in even if that pile doesn't contain an exact match due to anonymization/pseudonymization. Also note that this means there isn't really any feasible way to "aggregate" data in such a way it can no longer be argued to be subject to the data subject rights of the GDPR unless the data is fully isolated (e.g. total number of monthly visitors of an entire website by year).

Post reply on HN