https://crypto.stanford.edu/flashproxy/
> There is an options page[1] (the same page you get by clicking on the badge) with which users can choose whether they want to be a proxy. By default, if a user has not made a choice, they will be a proxy. If you want only people who have explicitly clicked "yes" to be a proxy, add the cookierequired parameter. If a user has selected "no," they will never be a proxy, regardless of the presence of cookierequired.
In either case, your ire is better directed at your browser.
It's like going to a kitchen remodeling store and hosting a dinner party there. Yes, they invited you in, but the scope of that invitation was looking at new counters, not hosting a party. That's trespassing. In the computer realm, it may well be a CFAA violation.
No such expectation exists for exploit packs and proxies like this.
Really, really obnoxious. I now have a serious grudge against this person.