palant

10 ms·

91.
by palant 5y ago
No, it isn’t PII in the legal sense, it doesn’t allow identifying you directly. Which doesn’t mean that it cannot be tied to your identity. Just one example: if you regularly post to social media what you bought online, this information cou
92.
by palant 5y ago
Found it. This is the optOut_crawl setting and its handling is entirely on the server side. So presumably if this setting is set, the server will no longer send the extension any instructions to scrape Amazon pages in background. Mind you,
93.
by palant 5y ago
Note : I am the author of the article above. Nice, I didn’t find this setting and I explicitly went looking for it. So the settings in the “price history” graph don’t merely apply to the way this graph is shown. Now I need to figure out wh
94.
by palant 5y ago
Note : I am the author of the article above. The history of all Amazon products you looked at or searched for is personal data, and it can tell a lot about you. Whether it is also personal data in the legal sense is not something I can s
95.
by palant 6y ago
Unfortunately, that’s only your word. The way this system is designed, nobody will notice if Amazon chooses to be less obsessive about it. Or if their systems are hacked. Are you certain that these web services are secure? I’m not (one obvi
96.
by palant 6y ago
Chrome has this functionality, other Chromium-based browsers most likely as well. But how many users would actually manage access lists for extensions?
97.
by palant 6y ago
The AMO team used to review every submitted add-on. They no longer do, now it just says “This add-on is not actively monitored for security by Mozilla. Make sure you trust it before installing.” on virtually every add-on. They still enforce
98.
by palant 6y ago
The whole extension is all about “let’s see when customers go to competition and try to bring them back.” That’s rather shady but it’s exactly the advertised functionality. And I’ve already got the first comment on the blog essentially sayi
99.
by palant 6y ago
That’s actually legitimate functionality of this extension. :-) Note: I am the author of this article.
100.
by palant 6y ago
Yes, you put considerable trust into applications running on your system. But I hope that you don’t just install random applications. You probably choose only vendors where you can reasonably assume that they don’t want to accept the backla
101.
by palant 6y ago
If Amazon does track some users of their extension right now, we wouldn’t know. It’s a web service, nobody can tell whether it behaves the same for everyone. It has all the privileges, and I can look into what it does with these privileges
102.
by palant 6y ago
Most of its functionality is meant to work on other websites. There is probably little reason to install it for amazon.com only. Note: I’m the author of this article.
103.
by palant 6y ago
You could also read the article before commenting. It’s one thing when an extension could do something but its code can be inspected to verify that it doesn’t. It’s an entirely different thing if it delegates its privileges to a web service
104.
by palant 6y ago
Nice research! Was that trick with mutation observers necessary however? If they add a constant noise vector, all you have to do is creating a canvas with known data, then call toDataURL() and compare what you get to the original data?
105.
by palant 6y ago
Because any kind of predictable noise can be easily calculated and removed. And randomized noise that changes on each call can be removed by making the call multiple times and averaging out the values. So a constant noise value isn’t the wo
106.
by palant 6y ago
Yes, I’ve been doing this in the past elsewhere. Quite a messy affair, you have to overwrite `Function.prototype.toString` – meaning for all functions, no real way to do it for a single function. And then you have to be very careful because
107.
by palant 6y ago
DuckDuckGo Privacy Essentials implement GPC as well, not sure about any other extensions. So ideally it won’t be usable to recognize Privacy Badger, rather a comparably large group of users of privacy solutions. Ideally of course this would
108.
by palant 6y ago
Fingerprinting works by grouping people. The smaller the group, the better. And the group where values change constantly is bound to be very small. Your assumption seems to be that these changes won’t be recognized. But they are very easy t
109.
by palant 6y ago
Unlikely. Some of this is very useful functionality being dumbed down, without real workarounds short of scrapping website functionality.
110.
by palant 6y ago
Then you will be the one presenting a new bogus value on every page load – something that makes you recognizable as part of a very small group. As explained in the article, random values are not the way.
111.
by palant 6y ago
It has its own issues: https://news.ycombinator.com/item?id=25375709
112.
by palant 6y ago
It tends to make animations sluggish, see for example https://github.com/framer/motion/issues/441 . That’s not because they are trying to track you but simply because requestAnimationFrame (which has its legit
113.
by palant 6y ago
…which has its own track record of subtle website breakage, something that is difficult to notice and impossible to mitigate short of disabling this globally. Don’t get me wrong, it’s nice that this exists, but it’s disabled by default for
114.
by palant 6y ago
Note : I’m the author of the article. I know, the solution presented there isn’t perfect. But IMHO it’s as close as it gets, and it should be sufficiently advanced that detection should be complicated due to differences in browsers and ext
115.
by palant 6y ago
I am the author of this blog post. It’s a very detailed description of the issue, so feel free to read only the “Why you should care” section. Also, let me know if something needs clarifying, I’ll see your questions here.
116.
by palant 6y ago
They don't. Mozilla at this stage is still a very idealistically motivated organization. Most people are trying hard to do the right thing. It's merely that real-life constrains often lead to rather suboptimal results, despite all
117.
by palant 6y ago
Yes, I realized that. I probably misunderstood the user who reported this.
118.
by palant 6y ago
I actually updated the article today to address this very line of thought. You can see the added text here: https://pbs.twimg.com/media/EgzgXUAXgAEkp-y?format=png&name=... It's not that I question the intentio
119.
by palant 6y ago
I doesn't say “grim” because you personally cannot circumvent the restrictions, it says so because of the impact this is going to have on the add-on ecosystem. Your trick isn't going to do you any good if nobody is developing&#x2F
120.
by palant 6y ago
Unfortunately, it was neither. However, I'm being told that Firefox Nightly allows you to install any add-ons, so maybe running it would be an option. I actually used the debugging functionality to install a temporary add-on. This is a

More ›