Slashdot Mirror
Amazon One-Click Chrome Extension Snoops On SSL Traffic
An anonymous reader writes "It turns out Amazon has its own sketchy method of snooping on all your browser traffic — even SSL traffic — through their one-click extension for Chrome. As designed, the extension reports every URL you visit, including HTTPS ones, to Amazon. It uses XSS to provide some of its functionality. It also reports contents of some website visits to Alexa. The Amazon extension has also been exploited to allow an attacker to gain access to SSL traffic on browsers that have it installed."
well, why the hell not I say? goog already captures your every move in chrome, so amazon may as well. not to mention NSA and China. I'll stick with Safari - at the very least Apple isn't monetizing my web surfing, so they don't have a per se motive for snooping around.
You want to upvote/downvote? Go back to Reddit! Here we mod up/mod down.
At this point is anyone even shocked by this? Let somebody in the door and they are going to peek in the closets if they can. Every company you interact with is recording and selling everything that can get their hands on.
Of course nothing will come of this. Amazon is a big player, they can get away with it.
And this is why browser extensions are a bad idea.
someone using it explain, please? what does one click buying need a browser extension for?
world was created 5 seconds before this post as it is.
"through their one-click extension for Chrome"
Avoid Google.
Avoid Google services.
Avoid Google products.
All of them.
Forever.
This makes me wonder if there'll be a general code review of browser extensions like HTTPS Everywhere and HTTPS Finder and the like. I hope that they aren't compromised.
Do not look into laser with remaining eye.
that Amazon will issue an apology saying the inadvertently sent the data to their servers. And Alexa's.
My workplace just installed a chrome browser frame that does something like this to protect their intellectual property here.
such that rense.com would be the first search result?
Ooh, moderator points! Five more idjits go to Minus One Hell!
Delendae sunt RIAA, MPAA et Windoze
"The Amazon Browser Apps may also collect information about the websites you view, but that information is not associated with your Amazon account or identified with you. "
"The Alexa functionality in the Amazon Browser Apps collects and stores information about the web pages you view. In some cases, that information may be personally identifiable, but Alexa does not attempt to analyze web usage data to determine the identity of any user. "
I find it exceptionally sick and depressing a toolbar which advertises itself to give user quick access to amazon feels a need to go one step further taking advantage of the same customer to spy on or facilitiate the spying on all of their activity. Is the amazon toolbar really not self-serving enough?
Added *.amazon.com to my DNS block list and now I feel slightly better.
My workplace just installed a chrome browser frame that does something like this to protect their intellectual property here.
I hope they're not expecting it to protect their IP from Google.
Amazon does a favor with their Alexa service for the whole internet. That is the only third party global site statistics tool which provides information for free. At least I do not know any other.
Of course they should fix the vulnerability. The real issue is that the current authorization systems only give half of the necessary information, they state what information the app access, but not what it does with those information, even though that could really make a difference. Therefore people become accustomed to give horrific permissions to any app.
This looks like it might be a violation of the Computer Fraud and Abuse Act, the part about "exceeds authorized access". File a criminal complaint with the FBI.
The evidence for TOR being safe is that, thus far, 0 people have been arrested by being de-anonymized. So, like I said, either it really is safe, or the NSA/FBI is keeping their snooping ability under wraps for something that will really make headlines. I wouldn't bet either way.
Socialism: a lie told by totalitarians and believed by fools.
I've watched the last few years as more and more of my web traffic was being routed to Amazon.com, for reasons unknown.
The more sites I visited the more links to Amazon I found (Netstat, or TCPview from systernals). I don't do any business with Amazon
as I have to pay taxes (Washington State resident), everything comes from NewEgg.com.
I've been blocking Amazon links (data collectors?) for all those years as well, but it's an uphill battle as more servers (addresses) are added all the time,
they've become very persistent. I think you'll find Amazon doing much worse than just reading HTTPS pages, but that's just a personal opinion.