Slashdot Mirror
Amazon One-Click Chrome Extension Snoops On SSL Traffic
An anonymous reader writes "It turns out Amazon has its own sketchy method of snooping on all your browser traffic — even SSL traffic — through their one-click extension for Chrome. As designed, the extension reports every URL you visit, including HTTPS ones, to Amazon. It uses XSS to provide some of its functionality. It also reports contents of some website visits to Alexa. The Amazon extension has also been exploited to allow an attacker to gain access to SSL traffic on browsers that have it installed."
well, why the hell not I say? goog already captures your every move in chrome, so amazon may as well. not to mention NSA and China. I'll stick with Safari - at the very least Apple isn't monetizing my web surfing, so they don't have a per se motive for snooping around.
You want to upvote/downvote? Go back to Reddit! Here we mod up/mod down.
someone using it explain, please? what does one click buying need a browser extension for?
world was created 5 seconds before this post as it is.
"through their one-click extension for Chrome"
Avoid Google.
Avoid Google services.
Avoid Google products.
All of them.
Forever.
My workplace just installed a chrome browser frame that does something like this to protect their intellectual property here.
Update: One day after the publication, Amazon did not stop tracking, but fixed the vulnerability - the config links are now served over HTTPS. Once again, full disclosure helped the common folks' security.
This is exactly the same as Facebook, Google, and other social network do with their buttons. And this is in no way different from tracking by ad networks.
Just use Ghostery.
"The Amazon Browser Apps may also collect information about the websites you view, but that information is not associated with your Amazon account or identified with you. "
"The Alexa functionality in the Amazon Browser Apps collects and stores information about the web pages you view. In some cases, that information may be personally identifiable, but Alexa does not attempt to analyze web usage data to determine the identity of any user. "
I find it exceptionally sick and depressing a toolbar which advertises itself to give user quick access to amazon feels a need to go one step further taking advantage of the same customer to spy on or facilitiate the spying on all of their activity. Is the amazon toolbar really not self-serving enough?
Added *.amazon.com to my DNS block list and now I feel slightly better.
My workplace just installed a chrome browser frame that does something like this to protect their intellectual property here.
I hope they're not expecting it to protect their IP from Google.
Do you remember when companies made their profits by selling you products that you wanted, instead of just using their retail operations as a front end to upskirt your personal data and sell that to...whomever?
Our economy has become the equivalent of a luxury hotel that makes its real profits by selling copies of your credit card swipes to hackers.
Used to be, when a company sold products, their customers were the people who bought those products. Today, when a company sells products, their real customers are oily characters standing out back, waiting to buy copies of your credit cards. The products they sell, whether stuff on Amazon or Android games, or bandwidth are just a front for their actual, much sleazier, business.
You are welcome on my lawn.
Amazon does a favor with their Alexa service for the whole internet. That is the only third party global site statistics tool which provides information for free. At least I do not know any other.
Of course they should fix the vulnerability. The real issue is that the current authorization systems only give half of the necessary information, they state what information the app access, but not what it does with those information, even though that could really make a difference. Therefore people become accustomed to give horrific permissions to any app.
Wrong.
It is a sleazy motel with cameras in every room, and the profits come from selling videos of you having sex, showering, and going to the toilet.
Death has been proven to be 99% fatal in lab rats.
At this point is anyone even shocked by this?
Well I was shocked when I heard that Amazon had a browser extension. I often shop Amazon, but never felt the need to install the extension. It serves no purpose.
But don't be so sure that Amazon is going to get away with it. If this is true, it could cost them millions.
They are not a common carrier, and have no safe harbor.
Sig Battery depleted. Reverting to safe mode.
For many, privacy has a value just like money does. Maybe not you. but many.
Well no shit. But I'm losing privacy with either vulnerability; but only one can drain my bank account. Therefore, the one that also drains my bank account is CLEARLY worse.
I've watched the last few years as more and more of my web traffic was being routed to Amazon.com, for reasons unknown.
The more sites I visited the more links to Amazon I found (Netstat, or TCPview from systernals). I don't do any business with Amazon
as I have to pay taxes (Washington State resident), everything comes from NewEgg.com.
I've been blocking Amazon links (data collectors?) for all those years as well, but it's an uphill battle as more servers (addresses) are added all the time,
they've become very persistent. I think you'll find Amazon doing much worse than just reading HTTPS pages, but that's just a personal opinion.