Would using native AI apps only prevent this? I think so right?
Correct. The article is about Chrome and MS Edge browser extensions.
8M users' AI conversations sold for profit by "privacy" extensions
61–70 of 261 posts
Re: 8M users' AI conversations sold for profit by "privacy" extensions
#62Earlier quoted context omitted.
> They look really legitimate on the outside If that looks use-italics "really legitimate" to you, then you might be easily scammed. I'm not saying they're not legitimate, but nothing that you shared is a strong signal of legitimacy. It would take a perhaps a few hundred dollars a month to maintain a business that looked exactly like this, and maybe a couple thousand to buy one that somebody else had aged ahead of ti…
[flagged]
Don't be rude. "Real person" here might live in any country of the world.
And also, why extension for vpn? I live in country where almost everybody uses vpn just to watch YouTube and read twitter, and none of my friends uses some strange extensions. There are open source software for that - from real vpn like wireguard, to proxy software like nekoray/v2raytun. Browser extension is the last thing I would install to be private.
Re: 8M users' AI conversations sold for profit by "privacy" extensions
#63The company behind this appears to be "real" and incorporated in Delaware. > Urban Cyber Security INC https://opencorporates.com/companies/us_de/5136044 https://www.urbancybersec.com/about-us/ I found two addresses: > 1007 North Orange Street 4th floor Wilmington, DE 19801 US > 510 5th Ave 3rd floor New York, NY 10036 United States and even a phone number: +1 917-690-8380 https://www.manhattan-nyc.com/businesses/urba…
> Urban VPN is operated by Urban Cyber Security Inc., which is affiliated with BiScience (B.I Science (2009) Ltd.), a data broker company.
> This company has been on researchers' radar before. Security researchers Wladimir Palant and John Tuckner at Secure Annex have previously documented BiScience's data collection practices. Their research established that:
> BiScience collects clickstream data (browsing history) from millions of users Data is tied to persistent device identifiers, enabling re-identification The company provides an SDK to third-party extension developers to collect and sell user data
> BiScience sells this data through products like AdClarity and Clickstream OS
> The identical AI harvesting functionality appears in seven other extensions from the same publisher, across both Chrome and Edge:
Hmm.
> They look really legitimate on the outside
Hmm, what, no.
We have a data collection company, thriving financially on lack of privacy protections, indiscriminant collection and collating of data, connected to eight data siphoning "Violate Privacy Network" apps.
And those apps are free... Which is seriously default sketchy if you can't otherwise identify some obviously noble incentives to offer free services/candy to strangers.
Once is happenstance, twice is coincidence, three (or eight) times is enemy action.
The only thing that could possibly make this look any worse is discovering a connection to Facebook.
Re: 8M users' AI conversations sold for profit by "privacy" extensions
#64Earlier quoted context omitted.
[flagged]
Don't be rude. "Real person" here might live in any country of the world. And also, why extension for vpn? I live in country where almost everybody uses vpn just to watch YouTube and read twitter, and none of my friends uses some strange extensions. There are open source software for that - from real vpn like wireguard, to proxy software like nekoray/v2raytun. Browser extension is the last thing I would install to be…
[flagged]
Re: 8M users' AI conversations sold for profit by "privacy" extensions
#65I don't understand why so many people are using / trusting VPNs "Let us handle all your internet traffic.. you can trust us.. we're free!" No thank you.
Yeah free VPN is totally a problem, but there's TLS so at least those users aren't getting their bank account information stolen.
TLS works when app is installed somewhere else, but not in browser itself. Browser actually handles TLS termination.
Re: 8M users' AI conversations sold for profit by "privacy" extensions
#66I don't understand why so many people are using / trusting VPNs "Let us handle all your internet traffic.. you can trust us.. we're free!" No thank you.
Yeah free VPN is totally a problem, but there's TLS so at least those users aren't getting their bank account information stolen.
Does tls means certificate pinning ?
Can't a vpn alter dns queries to return a proxy website to your bank, using a forged certificate ?
Re: 8M users' AI conversations sold for profit by "privacy" extensions
#67I stick to extensions that Mozilla has manually vetted as part of the Firefox recommended extensions program.
> Firefox is committed to helping protect you against third-party software that may inadvertently compromise your data – or worse – breach your privacy with malicious intent. Before an extension receives Recommended status, it undergoes rigorous technical review by staff security experts.
https://support.mozilla.org/en-US/kb/recommended-extensions-...
I know that Google hates to pay human beings, but this is an area that needs human eyes on code, not just automated scans.
Re: 8M users' AI conversations sold for profit by "privacy" extensions
#68Earlier quoted context omitted.
> They look really legitimate on the outside If that looks use-italics "really legitimate" to you, then you might be easily scammed. I'm not saying they're not legitimate, but nothing that you shared is a strong signal of legitimacy. It would take a perhaps a few hundred dollars a month to maintain a business that looked exactly like this, and maybe a couple thousand to buy one that somebody else had aged ahead of ti…
[flagged]
> you'll have a better shot at dragging an actual person in front of a judge than for 99% of the other crap that's on the chrome web store
Based on what? The same instinct that told you having an address and phone number makes an entity legitimate? The chance the people behind this company live in the US is incredibly low. And even if they do live in the US what exactly would they be getting charged with and who would care enough to charge them?
Re: 8M users' AI conversations sold for profit by "privacy" extensions
#69The company behind this appears to be "real" and incorporated in Delaware. > Urban Cyber Security INC https://opencorporates.com/companies/us_de/5136044 https://www.urbancybersec.com/about-us/ I found two addresses: > 1007 North Orange Street 4th floor Wilmington, DE 19801 US > 510 5th Ave 3rd floor New York, NY 10036 United States and even a phone number: +1 917-690-8380 https://www.manhattan-nyc.com/businesses/urba…
Judging from their website, all links eventually point to either the VPN extension download website, or a signup link. I'm not surprised if some nation state supported APT is behind this shit.
Re: 8M users' AI conversations sold for profit by "privacy" extensions
#70Earlier quoted context omitted.
[flagged]
> you'll have a better shot at dragging an actual person in front of a judge than for 99% of the other crap that's on the chrome web store Based on what? The same instinct that told you having an address and phone number makes an entity legitimate? The chance the people behind this company live in the US is incredibly low. And even if they do live in the US what exactly would they be getting charged with and who woul…
[flagged]