It will be interesting to see how the developers of this extension respond to Google’s roll out of extensions Manifest V3 - the new specification could almost be directly targeting them: with service worker replacing background script there will no longer be a concealed window to mount those iframes. Thanks to the author for this write-up
Amazon Assistant lets Amazon track your every move on the web
31–40 of 67 posts
Re: Amazon Assistant lets Amazon track your every move on the web
#32Seems to me that browser extensions need better access control. Why isn't it possible to restrict it to just amazon.com itself, for example?
Browser extensions being enabled for all webpages by default is bad practice for security and privacy. Often the user only wants to use the extension on specific webpages. For example, if I have a video downloader extension, chances are that I only want to use that extension on the page with the specific video I want to download. Extensions should be disabled by default upon install. If the user wants to use the exte…
Steps have been taken toward making this the norm in Chrome but it’s not clear yet to what degree it will be enforced. Already user can chose on install or at a later time to limit the domains an extension is active on (no matter what permissions it requests) and the ‘declarative’ model for interactions (wake on invocation by user or declare rules/lists to be applied on your behalf by the browser itself) is heavily promoted.
Re: Amazon Assistant lets Amazon track your every move on the web
#33Seems to me that browser extensions need better access control. Why isn't it possible to restrict it to just amazon.com itself, for example?
Browser extensions being enabled for all webpages by default is bad practice for security and privacy. Often the user only wants to use the extension on specific webpages. For example, if I have a video downloader extension, chances are that I only want to use that extension on the page with the specific video I want to download. Extensions should be disabled by default upon install. If the user wants to use the exte…
My extension is intended to work from any site (Browser Routr). I could dynamically update the extension manifest from its complimentary native app, but that creates races with the extension update process. And for many extension the concerns are cross cutting. For example I want dark style overrides everywhere.
Re: Amazon Assistant lets Amazon track your every move on the web
#34Earlier quoted context omitted.
> It’s an entirely different thing if it delegates its privileges to a web service that could do anything and that nobody can inspect. Would it be more accurate then to say it potentially lets Amazon track you? Without the word "potentially," or similar, it makes it sound like they are in fact doing it when you just said it "could."
To be clear, I'm not the author so I cannot answer on their behalf. In my opinion though, "could" is so close to "potentially" in definition that it seems rather pedantic to hinge the entire article and its conclusions on that single choice of word.
The title of the article on HN does not contain any such qualifiers.
Actual Title: How Amazon Assistant lets Amazon track your every move on the web
HN Title: Amazon Assistant lets Amazon track your every move on the web
I should have been more specific.
Re: Amazon Assistant lets Amazon track your every move on the web
#35The assistant should play the tune of "Every Breath You Take" by The Police when its doing this.
Being Amazon, updating it to "Every break you take" feels more appropriated.
Re: Amazon Assistant lets Amazon track your every move on the web
#36Is there a need for iframes to exists today? Can we somehow block them?
Re: Amazon Assistant lets Amazon track your every move on the web
#37Excellent article by the author.
The subtle point of delegating everything to remote services is your user doesn't need to know when you've modify behavior. If Amazon were to bundle the content, you'd need to explicitly update your extension.
You're delegating to Amazon that they'll continue to respect your privacy (no claims were made they weren't), but also their systems are secure, and will continue to be. This is too much trust to give any entity. No thanks.
From Amazon's perspective, they probably have more than one team working on the extension. A coordinated deployment process at scale is painful. Allowing each team to deploy to its own endpoint and communicate with other components via message passing (events) is exactly how you'd expect a company that grew up on SOA to design.
Re: Amazon Assistant lets Amazon track your every move on the web
#38This place is becoming like Reddit with the conspiracy theories
Re: Amazon Assistant lets Amazon track your every move on the web
#39This place is becoming like Reddit with the conspiracy theories
Hahaha, take your meds you schizo incels, right?
Ya ever think you could be overdoing it a tad? It's becoming a joke you know...