Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

8M users' AI conversations sold for profit by "privacy" extensions

koi.ai

Post reply on HN
Print view View original

91–100 of 261 posts

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#91

Post by Santosh83 »

GeekyBear wrote: post #67

I stick to extensions that Mozilla has manually vetted as part of the Firefox recommended extensions program. > Firefox is committed to helping protect you against third-party software that may inadvertently compromise your data – or worse – breach your privacy with malicious intent. Before an extension receives Recommended status, it undergoes rigorous technical review by staff security experts. https://support.mozi…

Yeah IT pros and tech aware "power" users can always take these measures but the very availability of poor or maliciously coded extensions and apps in popular app stores makes it a problem considering normies will get swayed by the swanky features the software promises and will click past all misgivings and warnings. Social engineering attacks are impossible to prevent using technical means alone. Either a critical mass of ordinary people need to become more safety/privacy conscious or general purpose computing devices will become more & more niche as the very industry which creates these problems in the first place by poor review will also sell the solution of universal thin-clients and locked down devices, of course with the very happy cooperation of govts everywhere.

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#93

Post by nrhrjrjrjtntbt »

Joker_vD wrote: post #81
mat_b wrote: post #47

I don't understand why so many people are using / trusting VPNs "Let us handle all your internet traffic.. you can trust us.. we're free!" No thank you.

For the same reason you trust your ISP? It handles all your internet traffic; and depending on where you live, probably has government-mandated back doors, or is willing to cooperate with arbitrary requests from law-enforcement agencies. That's why TLS exists, after all. All Internet traffic is wiretapped.

TLS doesnt hide IP addresses

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#94

Post by g947o »

x-complexity wrote: post #39
pyrolistical wrote: post #27

Earlier quoted context omitted.

Probably not. All side effects need to go through the js side. So you can alway see where http calls are made

> Probably not. All side effects need to go through the js side. So you can alway see where http calls are made That can be circumnavigated by bundling the conversations into one POST to an API endpoint, along with a few hundred calls to several dummy endpoints to muddy the waters. Bonus points if you can make it look like an normal-passing update script. It'll still show up in the end, but at this point your main go…

As soon as you hijack the fetch function (which cannot be done with WebAssembly alone), it's going to look suspicious, and someone who looks at this carefully enough will flag it.

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#96

Post by onion2k »

banku_brougham wrote: post #84
throw310822 wrote: post #74

[flagged]

I would figure state actors don’t need to go through the trouble of a browser extension. But, yeah.

I'm not a spy so I don't know, but surely in most scenarios it's a lot easier to just ask someone for some data than it is hack/steal it. 25 years of social media has shown that people really don't care about what they do with their data.

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#97

Post by Leptonmaniac »

onion2k wrote: post #96
banku_brougham wrote: post #84

Earlier quoted context omitted.

I would figure state actors don’t need to go through the trouble of a browser extension. But, yeah.

I'm not a spy so I don't know, but surely in most scenarios it's a lot easier to just ask someone for some data than it is hack/steal it. 25 years of social media has shown that people really don't care about what they do with their data.

Wasn't there a comment on this phenomenon along the lines "we were so afraid of 1984 but what we really got was Brave New World"?

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#99

Post by automatedideas »

Oarch wrote: post #43
notjonheyman wrote: post #13

From my experience, Google does not do a thorough app review. Reviewers get maybe a few minutes to review and move on due to the volume of apps awaiting review.

I imagine this would be a great use case for AI helping out?

“There’s too much human harmful code to review and too few human reviewers.”

“I know, let’s have an AI do all the work for us instead. Let’s take a coffee break.”

Re: 8M users' AI conversations sold for profit by "privacy" extensions

#100

Post by growt »

mjmas wrote: post #92

> This means a human at Google reviewed Urban VPN Proxy and concluded it met their standards. Or that the review happened before the code harvested all the LLM conversations and never got reviewed after it was updated.

I think this is most likely what happened. The update/review process for extensions is broken. Apparently you can add any malicious functionality after you’re in and also keep any badges and recommendations.
Post reply on HN