7 ms·
Firefox add-on with 7m downloads secretly tracks your browsing history
- raintrees 15y agoBigend at work? Blue-Ant? Thanks, Mr. Gibson... And thanks to Simon, I am having a hard enough time with my work and personal to do lists, testing all of my tools for their extranet behaviors is not something I look forward to adding to them...
- rsoto 15y agoThe lesson here: don't install shady addons, just as you aren't installing every damn toolbar out there. Also, this is enough to sue, isn't it?
- EwanToo 15y agoRather depressingly, this wasn't so much a shady add-on, as one that was meant to have been vetted by Mozilla. From the Mozilla Add-Ons FAQ @ https://addons.mozilla.org/en-US/firefox/faq https://addons.mozilla.org/en-US/firefox/faq Are add-ons safe to install? Unless clearly marked otherwise, add-ons available from this gallery have been checked and approved by Mozilla's team of editors and are safe to install. We recommend that you only install approved add-ons. If you wish to install unapproved add-ons or add-ons from third-party websites, use caution as these add-ons may harm your computer or violate your privacy. Learn more about our approval process
- starwed 15y ago"Unless clearly marked otherwise" This add-on was marked otherwise. (Well, according to the claims above.) You can definitely argue that having unvetted add-ons on the site at all is bad, but your particular point isn't relevant.
- cake 15y agoI've seen this before in an other smaller extension (I can't remember which) while I was studying how it worked, but fortunatly the code was commented. Firefox extensions are just plain zip files, I wonder why he hasn't checked the code.
- WalterGR 15y agoLike Apple products, Firefox branded itself as malware proof. --- http://web.archive.org/web/20041127034451/http://www.mozilla.org/products/firefox/ http://web.archive.org/web/20041127034451/http://www.mozilla... "“Beware of spyware. If you can, use the Firefox browser.” - USA Today" "Privacy and Security Built with your security in mind, Firefox keeps your computer safe from malicious spyware by not loading harmful ActiveX controls. A comprehensive set of privacy tools keep your online activity your business." --- While that's technically correct - Firefox couldn't (can't?) load ActiveX controls, therefore it could't load harmful ActiveX controls - the Firefox extensions system has permitted installation of executable code for a long time, if not since its inception. Since that's what ActiveX is, more or less, Firefox has never been any more secure in that respect than e.g. Internet Explorer. Like Apple products, as Firefox becomes more popular (and therefore a jucier attack target) there will be more malware that targets it.
- alecco 15y agoAre you blaming Mozilla/Firefox for every possible 3rd party misuse of their software?
- WalterGR 15y agoNo. And rereading my post, I'm just not seeing any blame. I'm presenting some pertinent history and tying it to the recent Apple malware news, which has been heavily discussed here.
- kevindication 15y agoThe difference being that you have to decide to install this harmful extension. ActiveX just gets loaded during regular browsing.
- WalterGR 15y agoActiveX hasn't worked that way for a long time. At least since XP SP2, released 2004. Possibly even before then - I'm not sure exactly what XP SP2 changed. Edit: Fix typo.
- nikcub 15y ago"This add-on has been preliminarily reviewed by Mozilla." What that entails: "When performing a preliminary review, editors will review the source code for security issues and major policy violations, but will not install the add-on to test functionality in most cases. Preliminary review will be granted unless a security vulnerability or major policy violation is discovered." From: https://addons.mozilla.org/en-US/developers/docs/policies/reviews#preliminary https://addons.mozilla.org/en-US/developers/docs/policies/re... Extensions marked 'experimental' are not fully reviewed. Which is why they probably left this plugin marked as 'experimental'. You can't blame the users since they are installing from a Mozilla page and trusting the brand. I hope this triggers a review of those procedures at Mozilla, since I would consider sending back every site you visit a 'major policy violation'. Very scary. Edit: they may also want to change the 'experimental' policy and set a time limit to how long an extension can remain experimental, and not list them in the default directory unless users (more advanced users) specifically seek out experimental extensions
- jokermatt999 15y agoI'm not sure if this is still the case, but you used to have to make an account and log in to actually install an experimental add on. There was also a clear warning as well. I definitely agree with setting a time limit, if feasible.
- natmaster 15y agoChrome tracks your browsing history... why do people suddenly care when there's an addon for Firefox that does that?
- MattBearman 15y agoI'd like to see some proof of that. Or in the words of Wikipedia, 'Citation Needed'
- Sargis 15y agoI'd like to see some proof as well. While there is some tracking involved in Chrome, I doubt they track browser history as well.
- timtadh 15y agoPerhaps the OP was referring the URL bar sending auto complete requests to google, which some consider tracking... I don't really know of anything else Chrome does by default that "tracks your history" like this addon does.
- sp332 15y agoChrome sends every keypress in the URL bar back too Google. http://www.google.com/chrome/intl/en/privacy.html http://www.google.com/chrome/intl/en/privacy.html When you type URLs or queries in the address bar, the letters you type are sent to your default search engine so the Suggest feature can automatically recommend terms or URLs you may be looking for.
- code_duck 15y agoThe autocompletion can easily be turned off. Anyhow, what is typed on the URL bar is only a small subset of sites visited.
- zerosanity 15y agoA quick fgrep found the code making the requests to their servers: http://pastie.org/1932287 http://pastie.org/1932287 Edit: Further code browsing points to the "rank" feature. They rank all URLs that are http/https and the host isn't "localhost". I'm guessing, but if you turn of ranking in the preferences, it will stop logging your page views.
- sudonim 15y agoWhy not try and track down Dima Sidorchenko (the guy in the header of the source)? Google thinks the name is Dima Sidorenko and offers up this guy who is a programmer: http://twitter.com/#!/shadow1278 http://twitter.com/#!/shadow1278 Unless it is Sidorchenko and Dima is a nickname in which case "Dmitriy Sidorchenko" might get better results.
- zerosanity 15y agoThe files I've looked at have been authored by many different people. (Seed, Zak, RigoNet, Camille, Dmitriy, Dima Sidorchenko, etc.) I don't think Dima is solely responsible for this. The company that had this written should be responsible.
- stevoski 15y agoDima is a standard Russian-language short form for Dmitriy. Like Pete for Peter in English. The name Sidorchenko sounds Ukrainian.
- derleth 15y agoThe Ant Video Downloader has been reported as spyware.
- willidiots 15y agoSeems like an overreaction, imho. This is likely a case of poor Privacy Policy writing and general ineptitude, rather than deliberate evil. From their feature list: "Easy to use : when a video is detected, the download button becomes clickable." - i.e. our plugin sends all URLs to us for analysis, we respond telling the plugin whether to activate the button "Integrated Traffic Rank indicator for all the sites you visit." - i.e. we need a way of measuring unique visits to everything Still, interesting, and good on this guy for bringing it into the public eye.
- cont4gious 15y agobut absolutely none of that requires a unique identifier, which is where this article focuses most of it's gripe.
- willidiots 15y agoIt seems like the "Integrated Traffic Rank indicator" could, if they wanted to distinguish uniqueness by users rather than unique IPs. Not that it's a good idea.
- beagle3 15y agoWhile I usually follow "do not ascribe to malice that which is adequately explained by stupidity", I don't think this case is adequately explained by stupidity.
- neanderdog 15y agodo a 'whois' on ant.com. I thought it interesting.
- suyash 15y agoYou should talk to a good attorney and file a Lawsuit against Mozilla and Ant.com, this could be big!
- runjake 15y agoSpoiler: Submission title is bait. He calls out "ant video downloader".
- feydr 15y agooh no! say it isn't true!!! it tracks our browsing history!!??!?! that's like as bad as dropping bombs on 8 year olds in iraq isn't it!
- sudonim 15y agoIt also makes you wonder what "Verified Safe by Norton" means on the page for their video downloader. http://www.ant.com/video-downloader http://www.ant.com/video-downloader http://safeweb.norton.com/report/show?url=www.ant.com http://safeweb.norton.com/report/show?url=www.ant.com The community rating contradicts norton's rating.... sigh.
- benmccann 15y agoI'm not familiar with Mozilla's add-on policies. Is this an issue due to the user tracking? Or is it because the privacy policy didn't make it clear this was happening?
- mickeyben 15y agoI don't really see the issue here, isn't all of that stated in the privacy policy of the extension ? https://addons.mozilla.org/en-US/firefox/addon/video-downloader-player/privacy/ https://addons.mozilla.org/en-US/firefox/addon/video-downloa... Ant.com collects non-personally-identifying information when you are visiting our site or using our software applications, this infomation made available typically from web browsers and servers. Some of the infomation type is: the Uniform Resource Locator (URL) of the web page from wich you came, the date and the time for each page you view, settings such as browser languages, etc. Ant.com also collects infomation made public to us that can be considered personally identifyable, such as your internet protocol (IP) address. Ant.com does not use such information to identify its visitors and does not disclose such information.
- barrkel 15y ago"The web page from wich you came" is just the HTTP "Referer" field; almost every web site in existence collects that as a matter of course. To claim that it covers universal monitoring of all users' web traffic is obscene. I'm also fairly sure that one can find personally "identifyable" information from URLs that go far beyond mere IP addresses. Why is ant.com domain info privacy protected anyhow? Seems pretty fishy to me.
- masklinn 15y agoAnd that's why I have Little Snitch on my machine.
- gyardley 15y agoI have Little Snitch on my machine too, but I've set up a rule that allows my browser to make calls to port 80. Are you saying you don't have a generic rule in place, and are instead using Little Snitch to approve calls to port 80 for every new domain you visit? If so, that'd certainly work, but it seems more than a little impractical.
- masklinn 15y ago> Are you saying you don't have a generic rule in place, and are instead using Little Snitch to approve calls to port 80 for every new domain you visit? Yes. And I do the same with cookies. I do allow connections (and cookies) permanently to "trusted sites", but that's the exception rather than the rule.
- Pistos2 15y agoWow, and here I thought I was the only one that did that! I do the same, though with Opera's built-in cookie control features.
- spydum 15y agoYet another reason to browse through an interception proxy. Know what you are sending -- it can be enlightening.
- fligtar 15y agoI'm from the add-ons team at Mozilla. We've looked into the Ant Video Player and found that it does send information about websites users visit in order to power its ranking feature displayed for each website, and also includes a unique identifier in this communication. While this does not violate our policies, we do require it to be disclosed in the privacy policy and the add-on's description. We have contacted the developer and asked them to correct this. The developer has been in communication with us and says that they destroy all user-identifiable information from their logs, and that their privacy policy and add-on description will be updated to reflect that. They'll also show a notice about this on their first-run website. Additionally, the AntRank feature that uses this tracking can be disabled. Add-ons publicly available in our gallery have been reviewed for security problems, and add-ons that aren't marked as experimental have been fully reviewed for a range of other issues as described in our hosting policies. Because developers set their own privacy policies and can update them any time, it is more difficult for us to review them for compliance with their own rules. We encourage users to always read an add-on's privacy policy if one is provided and to use the Report Abuse link if anything suspicious is noticed.
- 9999 15y agoYou should create a policy that completely prohibits this behavior.
- CWuestefeld 15y agoNot everyone has the same values as you. There's nothing inherently wrong with not caring if somebody knows where you surf, and being interested in the recommendations that their tool can provide. Disclosure is good. Homogeneity and coercion are bad.
- redthrowaway 15y agoExactly. From what I can tell, there's not much difference between the information ant is collecting and that that's regularly sent back to Google from Chrome, except that the latter is likely even more invasive.
- gluejar 15y agoabout 150,000 people have downloaded the bit.ly preview add-on, which tells bit.ly everything you visit: http://go-to-hellman.blogspot.com/2010/05/bitly-preview-add-on-leaks-user.html http://go-to-hellman.blogspot.com/2010/05/bitly-preview-add-...
- dedward 15y agoPrivacy policy or not - if it's purpose is to be a video downloader, but it tracks stuff when you are doing something other than video downloading - it's sneaky at best, however it's presented.
- dedward 15y agoPrivacy policy or not - if it's purpose is to be a video downloader, but it tracks stuff when you are doing something other than video downloading - it's sneaky at best, however it's presented.