Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Amazon Assistant lets Amazon track your every move on the web

palant.info

Post reply on HN
Print view View original

51–60 of 67 posts

Re: Amazon Assistant lets Amazon track your every move on the web

#51

Post by palant »

happyconcepts wrote: post #29
palant wrote: post #19

Earlier quoted context omitted.

Most of its functionality is meant to work on other websites. There is probably little reason to install it for amazon.com only. Note: I’m the author of this article.

Which browsers allow users to whitelist specific sites for access by a browser extension? Or else what is the !#?!% technology hurdle preventing users from making their own lists?

Chrome has this functionality, other Chromium-based browsers most likely as well. But how many users would actually manage access lists for extensions?

Re: Amazon Assistant lets Amazon track your every move on the web

#52

Post by palant »

mgdev wrote: post #47

I designed this. I won't speak to any past or current practices, but I will say this: Amazon is obsessive about protecting customer privacy.

Unfortunately, that’s only your word. The way this system is designed, nobody will notice if Amazon chooses to be less obsessive about it. Or if their systems are hacked. Are you certain that these web services are secure? I’m not (one obvious vulnerability has been reported). If someone compromises one of these services, the results will be disastrous.

Note: I am the author of the article above.

Re: Amazon Assistant lets Amazon track your every move on the web

#53

Post by unhba »

mgdev wrote: post #47

I designed this. I won't speak to any past or current practices, but I will say this: Amazon is obsessive about protecting customer privacy.

I work on a shopping assistant type browser extension and I am very confident that if I proposed an architecture and implementation such as the author identifies here I would be turned down immediately: having good intentions around privacy is one thing but deliberately designing your application in a way that allows to bypass almost entirely the review process required on submission to the store is something that should be answered for.

Re: Amazon Assistant lets Amazon track your every move on the web

#54

Post by EveYoung »

jackson1442 wrote: post #45
ocdtrekkie wrote: post #43

Earlier quoted context omitted.

If the dominant web browser wasn't an ad company, browser extensions would not exist in the way they do today. Because any responsible security engineer would nuke browser extensions from orbit, but currently everyone who isn't an ad company has to maintain feature parity with the ad company for competitive reasons. They are by far the most risky thing one could possibly put on a PC. They essentially remove any alleg…

Huh? From my point of view extensions like uBlock Origin and 1PasswordX further enhance and secure my browsing, with uBO I'm blocking ads and trackers (including malicious ones) and with 1Pass I get secure form fill. Novelty extensions are a completely different story but I wouldn't go so far as to ban all extensions ever.

But how would you differentiate between useful and gimmicky extensions? If you give users freedom, it always comes with a risk. For the average user, a system like Safari on iOS might be the best solution while more advanced users should have the option to install whatever they like.

Re: Amazon Assistant lets Amazon track your every move on the web

#55

Post by mgdev »

palant wrote: post #52
mgdev wrote: post #47

I designed this. I won't speak to any past or current practices, but I will say this: Amazon is obsessive about protecting customer privacy.

Unfortunately, that’s only your word. The way this system is designed, nobody will notice if Amazon chooses to be less obsessive about it. Or if their systems are hacked. Are you certain that these web services are secure? I’m not (one obvious vulnerability has been reported). If someone compromises one of these services, the results will be disastrous. Note : I am the author of the article above.

Speaking for myself, not the co: we all decide who we want to trust and why, whether it’s browser extension, or a browser, or a phone.

For me, it comes down to alignment and value. Amazon stands to lose a lot if they decided to suddenly stop caring about customers, or not take security seriously. And the Internet gets pretty small if your threat model requires zero trust.

Re: Amazon Assistant lets Amazon track your every move on the web

#56

Post by bagacrap »

palant wrote: post #3
KoftaBob wrote: post #2

"Still, I was astonished to discover that Amazon built the perfect machinery to let them track any Amazon Assistant user or all of them: what they view and for how long, what they search on the web, what accounts they are logged into and more. Amazon could also mess with the web experience at will and for example hijack competitors’ web shops. Amazon Assistant log with a borg eye Image credits: Amazon, nicubunu, Open…

You could also read the article before commenting. It’s one thing when an extension could do something but its code can be inspected to verify that it doesn’t. It’s an entirely different thing if it delegates its privileges to a web service that could do anything and that nobody can inspect. Note: I’m the author of this article.

This distinction seems somewhat meaningless in practice. Are you going to audit every line of every extension you install, assuming it's all local code? And are you going to do this again every time it's (automatically) updated?

Re: Amazon Assistant lets Amazon track your every move on the web

#57

Post by alisonkisk »

cptskippy wrote: post #27
TedDoesntTalk wrote: post #26

> Putting these JavaScript files into the extension would have been possible with almost no code changes The AMO team at Firefox used to outright ban addons with remote script injection. I guess it matters who you are -- like on the Apple App Store, big names just need to pull the right strings or call the right people for a free pass. Rules are not applied equally. The playing field is NOT level.

> Rules are not applied equally. The playing field is NOT level. That's true, always has been. > big names just need to pull the right strings or call the right people for a free pass I'd be curious if that's the case. For the most part in B2B, "the rules" generally only apply when the risk of a client doesn't out weight the benefit of that client. T&C and Contracts are always negotiable, it's just a matter of if it'…

If you did exactly what Amazon did you'd be "evil", but they get a pass because they bought the companies they sell data to.

Re: Amazon Assistant lets Amazon track your every move on the web

#58

Post by alisonkisk »

MikeUt wrote: post #48
mgdev wrote: post #47

I designed this. I won't speak to any past or current practices, but I will say this: Amazon is obsessive about protecting customer privacy.

> protecting customer privacy Does "privacy" mean Amazon will spy on their customers, but won't share that data further?

Yes. It means they don't outsource privacy exploitation.

Re: Amazon Assistant lets Amazon track your every move on the web

#59

Post by alisonkisk »

bagacrap wrote: post #56
palant wrote: post #3

Earlier quoted context omitted.

You could also read the article before commenting. It’s one thing when an extension could do something but its code can be inspected to verify that it doesn’t. It’s an entirely different thing if it delegates its privileges to a web service that could do anything and that nobody can inspect. Note: I’m the author of this article.

This distinction seems somewhat meaningless in practice. Are you going to audit every line of every extension you install, assuming it's all local code? And are you going to do this again every time it's (automatically) updated?

Yes. This is exactly what happened with Great Suspender, which led to Google being succesfully pressured to ban it.

Re: Amazon Assistant lets Amazon track your every move on the web

#60

Post by alisonkisk »

tantalor wrote: post #24
palant wrote: post #22

Earlier quoted context omitted.

That’s actually legitimate functionality of this extension. :-) Note: I am the author of this article.

Covering up your competitors ads with your own sounds a lot like "mess with the web experience at will and for example hijack competitors’ web shops". Disclaimer: I work for Google Shopping, but not the ads part :)

Yes, but that part is with user consent, so it's an attack on Google and their partners, not an attack on the user.
Post reply on HN