Slashdot Mirror
Web of Trust, Downloaded 140M Times, Pulled From Extension Stores After Revelations That It Sells Users' Data (theregister.co.uk)
According to multiple reports, Web of Trust, one of the top privacy and security extensions for web browsers with over 140 million downloads, collects and sells some of the data of its users -- and it does without properly anonymizing it. Upon learning about this, Mozilla, Google and Opera quickly pulled the extension off their respective extension stores. From a report on The Register: A browser extension which was found to be harvesting users' browsing histories and selling them to third parties has had its availability pulled from a number of web browsers' add-on repositories. Last week, an investigative report by journalists at the Hamburg-based German television broadcaster, Norddeutscher Rundfunk (NDR), revealed that Web of Trust Services (WoT) had been harvesting netizens' web browsing histories through its browser add-on and then selling them to third parties. While WoT claimed it anonymised the data that it sold, the journalists were able to identify more than 50 users from the sample data it acquired from an intermediary. NDR quoted the data protection commissioner of Hamburg, Johannes Caspar, criticising WoT for not adequately establishing whether users consented to the tracking and selling of their browsing data. Those consent issues have resulted in the browser add-on being pulled from the add-on repositories of both Mozilla Firefox and Google Chrome, although those who have already installed the extension in their browsers will need to manually uninstall it to stop their browsing being tracked.
It was in their terms of service. It's common and benign (most sites do it to some extent without explicitly stating that). I don't understand what else you could imagine the business model was or why this would be surprising.
Often wrong but never in doubt.
I am Jack9.
Everyone knows me.
Yet again. You need to start _PAYING_ for your software. This will happen again and again. Start paying your developers, people ! If you don't, then they're going to find another way to get paid, and you probably won't like it.
Who is the author and developer of that extension? I smell Mossad.
Is a class action lawsuit available in such cases? While I can understand that they need to make money, siphoning full browser histories is sketchy. Failing to properly anonymize the data is criminal negligence that can put people at risk of all sorts of things, the least of which being spam and identify theft.
Now what did we all learn this time? That's right, no extension is a good extension if you can't validate the code yourself.
Seriously folks, don't do addons.
You can only trust the trusted. Not stuff that runs on them.
-- Tigger warning: This post may contain tiggers! --
Everybody always says the opposite of what they mean.
If they call themselves the "web of trust", then it means exactly the opposite.
Real blockers like uBlock Origin don't try so hard to convince you of what they're doing.
You were mistaken. Which is odd, since memory shouldn't be a problem for you
APK is a big ol' dick, as big as a dick can be,
He's got a purple helmet and wrinkled shaft,
And he pierces anuses for free!
I found this very thing out as a result of a email-based survey I'd sent to about 500 people. Here's a copy of the email I'd sent out to those affected:
-----
tl;dr version:
* The “Web of Trust” plugin is highly likely to be sending your browsing history, after it reaches the Web of Trust servers, to advertising companies.
* It’s likely that they’re _not_ sending personal details, but simply the list of URLs that you visit. This includes “private” urls such as what you received for the survey, but could also include things like the URLs you send when you share files via Dropbox, Hipchat, etc.
* If you’re not okay with this behaviour, I recommend you un-install the Web of Trust plugin.
* If you haven’t yet responded to my question of “do you have Web of Trust” installed, I’m still interested in hearing from you.
Detailed version:
* Shortly after folk started to respond to the survey, by chance I noticed unusual requests hitting the web server. An hour or two after the flurry of requests that I’d consider normal, I saw another request to _just_ the main URL, all from the same IP address (52.71.155.178), and the same user agent (Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/600.1.25 (KHTML, like Gecko) Version/8.0 Safari/600.1.25)
To me, this implies that the supposedly secret URLs were not very secret.
* The address 52.71.155.178 has a DNS entry "nat-service.aws.kontera.com”. Kontera is an advertising company (remember those “in text” ads with the double underscore? Kontera was one of the players in that), which was bought by Amobee, a market research company. Amobee own the kontera.com domains and likely is related to the above activity.
* From some research, I discovered that others have seen these requests too, all to private URLs, and that the plugin “Web of Trust” was implicated.
https://www.abuseipdb.com/chec...
http://www.liveipmap.com/52.71...
* I saw 15 of these requests. I contact each of the 15 people and received 11 responses. 9 of the respondents were using the Web of Trust plugin.
* I don’t know what could explain the other 2. Certainly, Web of Trust can’t be the only company sending Kontera/Amobee data. Unfortunately attempts to replicate the issue for those two users have failed: it may be that Kontera have some kind of limit on how many URLs per domain they’ll probe per time period? I’d certainly want to do that if I wanted to stay under the radar, or thwart further analysis.
Conclusion:
Given that 9/11 is far, far above the expected install base of Web of Trust. It is very likely that Web of Trust is indeed forwarding your browser history to at least one advertising company: Kontera/Amobee
Sharing “non personal information” is not inconsistent with Web of Trust’s privacy policy: they do not consider the URLs you visit to be “personally identifiable information”.
Response:
What you do with the sites you visit is up to you. But if you don’t approve of what the company behind the plugin is doing, I suggest you uninstall this plugin. Apart from the risk of “private URLs” becoming non-private, I don’t think there’s any further security risk.
I am disinclined to make a wide announcement about this, especially not on WoT’s forums. From research, the company readily squashes any criticism against it, and a small but vocal fraction of its users have embarked on attacks against any persons or sites that have raised concerns against WoT’s activity. In many ways, WoT has become an extortion engine, such as offering a paid-for “badge of trust” to remove bad ratings.
http://mywot.info/
One could only assume that, of the millions of browser/extension installs out there, a certain percentage are being used by minors, a.k.a. children. I'll be generous and say this figure is, oh, 5%.
So my question is, why is this company cyber-stalking, gathering information on, and virtually following 7 million innocent, defenseless little children around, gathering information on them, and selling this information to... who knows...? I mean, not only is this behavior disturbing and creepy, but is certainly illegal in many places. And who is to say who is buying up this information on your children?
And what are the purchases of this information doing with it? Why would they want to know exactly what your children are doing?
Won't someone think of the children?
Two things that should never go together without "no" between them:
"web of"
"trust"
Webs are sticky. They catch the spider's prey and don't let go.
Moderating "-1, Disagree" is simple censorship. Have the guts to post your opinion.
On a site where you need to use both, you allow uMatrix to pass-through what you want fine-grained-control over (e.g. specific scripts, or inline-scripts). Then either:
Sorry asshole, I have a policy against using software written by spammers.
Adblock's ads are one-click disable-able and disclosed publicly up front in the installation and documentation. WOT by contrast did their shit in secret and has no way to disable it, and is untrustworthy by that criteria. It's night and day.
Get a clue.
Speak for yourself and get a clue loser. Neither one does a fraction of what hosts do for many orders of magnitude less and faster in kernelmode where addons bloat messagepassing, memory and cpu use, and are in slower usermode too. You lose, loser (again).
Seriously folks, don't do computers.
You can only trust the trusted. Not stuff that runs on them.
How can you trust an operating system you haven't read the code of yourself? How can you trust chips running firmware you haven't read the code to? How do you know the precious metals in the hardware wasn't mined using slave labor in Africa? How do you know the computer companies you bought it from aren't paying lobbyists to oppose your interests?
Hell, look up "Reflections on Trusting Trust." You could read and understand the source code yourself, build it all from scratch, and your compiler could be compromised such that the resulting binaries aren't trustworthy either. Guess you'd better start reading the source to your compiler then, too...
Unity? Screw that: XFCE. Slashdot Beta? Screw that: SoylentNews. Australis? Screw that: Pale Moon. UX developers DIAF
Jack Byrnes is sooooo disappointed in them.
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
A "ne'er-do-well" like you could never write your own software. You're a no talent menial is why and you know it. We do. Hahahaha.
Not in Chrome.It will work in Firefox, unless|until they break that feature during their stalwart march to Chrome-Addon compatibility.
We do.
Congratulations! Admitting your schizophrenia is the first step to getting help.
Except that there is a difference between "anonymous" browsing data and "aggregated, anonymous data".
If they were collecting and selling "aggregated, anonymous data" then it would be something like this: 10k of our users visit xyz.com daily and 15k visit bca.com daily. However what they were doing is selling data that says user fda24ec3 visited this list of sites today and user c37a7e7b visited this other list of sites today.
Now do you see why collecting and selling "anonymous" individualized data is a problem? Because as we have seen it is fairly easy to reverse the process and determine that user c37a7e7b is actually John Smith who lives at 123 Nowhere St in Beverly Hills California with a phone number of 310-555-1212.
Alex, stop referring to yourself in the third person. You've never fooled anyone into thinking that anyone supports you. You only embarrass yourself further by showing that you have no friends.
UBlock can't do these as well as (or @ all) hosts do 4 speed, security, & reliability:
1.) Protect vs. bad sites (past ads)
2.) Protect vs. fastflux botnet C&C's
3.) Protect vs. dyndns botnet C&C's
4.) Protect vs. DGA botnet C&C's
5.) Protect vs. downed DNS (reliability)
6.) Protect vs. DNS poisoned dns
7.) Protect vs. trackers
8.) Protect vs. spam payloads
9.) Protect vs. phish payloads
10.) Protect vs. caps
11.) Get past dns blocks
12.) Keep off dns request logs
13.) Speed up 2 ways (adblocks/hardcodes)
14.) Work on anything webbound multiplatform.
15.) Ez data edit
16.) Block ads more efficiently in cpu/ram/I-O use
17.) UBlock now uses hosts (no DNS benefits vs. dns issues) - poor imitation = "sincerest form of flattery"
Hosts = native vs. illogically "Bolting on 'MoAr'" & not ClarityRay blockable like addons.
APK
P.S.=> Hosts (1st resolver) do MORE w/ less in fast kernelmode & before slow usermode addons
Hosts ~3mb vs. UBlock = 64MB -> http://cdn.ghacks.net/wp-conte...
WoT?
his hosts program is actually pretty good by xenotransplant
his hosts tool is actually useful for those cases in which one does indeed want to locally block stuff outright while consuming minimum system resources by alexgieg
I've never tried to belittle (APK's) work, I've flat out said it's good by BronsCon
take a look at the APK hosts file engine by SuperKendall
APK is kinda right. I've tried his hosts file generating software. It works by bmo
APK is totally right on this count. Adblock Plus on Firefox mobile is a dog on older, or lower end, phones. A hostfile based adblocker makes for a much better experience by chihowa
I like your host file system by Karmashock
I find your hosts file admirable by vel-ex-tech
* My code's liked/used + recommended & hosted by Malwarebytes' hpHosts - Argue w/ those folks above.
APK
P.S.=> See subject - & those users above: Eat your words as many support me (want more?)... apk
... someone going to jail maybe? Or is that all?
Your bad minusmods of apk's posts to try hide 'em and your unidentifiable ac troll posts = credible? *Laughter* (not!).
You pretending not to be APK is even less credible. The guy in your head who says "minusmods," does he have a name?
I support APK's stand on the hosts file by Trax3001BBS
Your premise that hostfiles are a good way to deal with advertising and malvertising is quite valid by JazzLad
APK was right! Is it time for us to point Sourceforge to a non-address in our hosts files by wonkey_monkey
APK's monolithic hosts file is looking pretty good by Culture20
APK... Awesome to see he's still spreading the good word by Molochi
ABP is insufficient as a solid hosts file does everything that APK reminds us about by fast turtle
APK, I know people give you a lot of shit regarding hosts, but please don't ever stop by nasredin
APK solution STILL relevant by Thud457
you're right about hosts files by drinkypoo
APK
P.S.=> Those folks above & in my last post != me - see subject - they host & recommend my work (how about you?)
Want even more?
(You PROJECT you sockpuppet + you DO use unidentifiable ac trolling of me (proves I have CRUSHED YOU BEFORE & you have to hide, lol))... apk
Hahaha no denyin Apk slapped you around 2x making you eat your words https://yro.slashdot.org/comme... + https://yro.slashdot.org/comme... it's apparent he's done that to you a lot I bet. Why? Now you troll him by unidentifiable ac posts and he could throw your past defeats at his hands right back at you and you know it. You're obviously butthurt and lazy. Don't be such a loser. Do something others like (even big names like malwarebytes) instead of wishing you were him. Wishes don't make good things happen. Good work does. Work like Apk's.
UBlock can't do these as well as (or @ all) hosts do 4 speed, security, & reliability:
1.) Protect vs. bad sites (past ads)
2.) Protect vs. fastflux botnet C&C's
3.) Protect vs. dyndns botnet C&C's
4.) Protect vs. DGA botnet C&C's
5.) Protect vs. downed DNS (reliability)
6.) Protect vs. DNS poisoned dns
7.) Protect vs. trackers
8.) Protect vs. spam payloads
9.) Protect vs. phish payloads
10.) Protect vs. caps
11.) Get past dns blocks
12.) Keep off dns request logs
13.) Speed up 2 ways (adblocks/hardcodes)
14.) Work on anything webbound multiplatform.
15.) Ez data edit
16.) Block ads more efficiently in cpu/ram/I-O use
17.) UBlock now uses hosts (no DNS benefits vs. dns issues) - poor imitation = "sincerest form of flattery"
Hosts = native vs. illogically "Bolting on 'MoAr'" & not ClarityRay blockable like addons.
APK
P.S.=> Hosts (1st resolver) do MORE w/ less in fast kernelmode & before slow usermode addons
Hosts ~3mb vs. UBlock = 64MB -> http://cdn.ghacks.net/wp-conte...
APK Hosts File Engine 9.0++ SR-4 32/64-bit https://www.google.com/search?...
Ads rob speed, security (malvertising) & privacy (tracking).
Hosts add speed (hardcodes/adblocks), security (bad sites/poisoned dns), reliability (dns down), & anonymity (dns requestlogs/trackers) natively.
Works vs. caps & PUSH ads.
Avg. page = big as Doom http://www.theregister.co.uk/2... & ads = 40% of it.
Hosts != ClarityRay blockable (vs. souled-out to admen inferior wasteful redundant slow usermode addons)
Less power/cpu/ram + IO use vs. DNS/routers/addons/antivirus (slows you) + less security issues/complexity.
Compliments firewalls (blocking less used IP addys vs. hosts blocking more used domains) & DNS (lightens dns load).
Gets data via 10 security sites.
APK
P.S. - Safe https://www.virustotal.com/en/... (Verified by Malwarebytes' S. Burn "seen the code & it's safe" http://forum.hosts-file.net/vi... )
I don't believe it!!!
***DUCKS***
This doesn't (more ability & efficiency too) APK Hosts File Engine 9.0++ SR-4 32/64-bit https://www.google.com/search?...
Ads rob speed, security (malvertising) & privacy (tracking).
Hosts add speed (hardcodes/adblocks), security (bad sites/poisoned dns), reliability (dns down), & anonymity (dns requestlogs/trackers) natively.
Works vs. caps & PUSH ads.
Avg. page = big as Doom http://www.theregister.co.uk/2... & ads = 40% of it.
Hosts != ClarityRay blockable (vs. souled-out to admen inferior wasteful redundant slow usermode addons)
Less power/cpu/ram + IO use vs. DNS/routers/addons/antivirus (slows you) + less security issues/complexity.
Compliments firewalls (blocking less used IP addys vs. hosts blocking more used domains) & DNS (lightens dns load).
Gets data via 10 security sites.
APK
P.S. - Safe https://www.virustotal.com/en/... (Verified by Malwarebytes' S. Burn "seen the code & it's safe" http://forum.hosts-file.net/vi... )
Anybody know of an alternative that i can trust. I really like the concept of WoT, i don't use it myself, but for other people it is a great aid to warn them that clicking on a link is safe or not.
On a long enough timeline, the survival rate for everyone drops to zero.
WOT has been broken for years they never really did anything to verify if reviews were accurate or even made by a human so that most phishing email links get a green light from WOT.
Build a Man a Fire, and He'll Be Warm for a Day. Set a Man on Fire, and He'll Be Warm for the Rest of His Life.
"Thru the mystic arts we harness energy & shape reality - We travel great distances in an instant" https://www.youtube.com/watch?feature=player_detailpage&v=HSzx-zryEgM#t=20/
"The Avengers protect the world from physical dangers - we safeguard it against more mystical threats" https://www.youtube.com/watch?feature=player_detailpage&v=kNdM7b1Lm04#t=31/
* Making it FASTER + SAFER vs. using remote DNS or browser addons for more security, speed, reliability & anonymity via what you have natively vs. illogically "Bolting on 'MoAr'" that uses more & DOES LESS!
APK
P.S.=> "How do I get from here to there?" https://www.youtube.com/watch?feature=player_detailpage&v=kNdM7b1Lm04#t=107/
ANSWER APK Hosts File Engine 9.0++ SR-4 32/64-bit https://www.google.com/search?hl=en&source=hp&biw=&bih=&q=%22APK+Hosts+File+Engine%22+and+%22start64%22&btnG=Google+Search&gbv=1/... apk
You're delusional. Enjoy Trumpland.
Curso NR 10 online curso NR 10 curso NR 10 online
But, but... you said apk has no supporters. The links in the posts you replied to show otherwise so who's delusional?
You say apk has no supporters embarassing yourself. 2 links show different https://yro.slashdot.org/comme... + https://yro.slashdot.org/comme...
Best hosts file creator APK Hosts File Engine 9.0++ SR-4 32/64-bit https://www.google.com/search?...
Ads rob speed, security (malvertising) & privacy (tracking).
Hosts add speed (hardcodes/adblocks), security (bad sites/poisoned dns), reliability (dns down), & anonymity (dns requestlogs/trackers) natively.
Works vs. caps & PUSH ads.
Avg. page = big as Doom http://www.theregister.co.uk/2... & ads = 40% of it.
Hosts != ClarityRay blockable (vs. souled-out to admen inferior wasteful redundant slow usermode addons)
Less power/cpu/ram + IO use vs. DNS/routers/addons/antivirus (slows you) + less security issues/complexity.
Compliments firewalls (blocking less used IP addys vs. hosts blocking more used domains) & DNS (lightens dns load).
Gets data via 10 security sites.
APK
P.S. - Safe https://www.virustotal.com/en/... (Verified by Malwarebytes' S. Burn "seen the code & it's safe" http://forum.hosts-file.net/vi... )