Emails a browser extension developer gets from scammers

They're given so much power so quickly. Users agree to 'view and modify website data' not realizing that the app can now run arbitrary code on their gmail/banking/whatever accounts to report all information including passwords. For all the concern over application security, little is talked about here.

Browser extensions are also super important. They stand as the only tool for users to take back control over their experience from companies that are in the interest of manipulating them for profit whenever they can. They are uniquely our agents here.

Still, each extension is a potential huge vulnerability. It's tough to find a balance here.

This resulted, among other things, in an almost universal degradation of performance and usability of Windows XP/Vista for ... our parents and grandparents, basically.

They should also add some monitoring regarding domains extensions talk to. Or even make developers add a description of outgoing requests from extensions somehow.

Which is slightly amusing because I must be getting enough traffic for them to want to find me.

Peer-to-peer proxy doesn’t mean a botnet, at least not how I think most people think that to mean. Rather they are routing traffic through residential IPs for a number of customers. $25-45/1000 users sounds exactly within the margins of a VPN provider (they even mention hola.org in the 3rd email, which is $2.99/m per ‘premium’ user or free if you become a node in the network) and residential proxies are also commonly used for scraping and other IP-sensitive work, again within those margins.

I didn’t find the code sample to be obfuscated, it was actually quite clear. It establishes a web socket with a server and simply passes requests through an endpoint, I.e. literally just a proxy.

All that said, it’s definitely shady to put this in your extension without users knowing. But, if you need to monetize something free, and make at least a good effort to inform users or allow them to opt out, and we trust infatica doesn’t allow illegal use of its proxy network, then I don’t really see the problem.

There’s a real need for residential IPs, no market to give each user $.025 and I can’t really fault someone for making a business out of this.

Edit: I also find irony that the author labels datos.live a “scammer” when in fact they are a very legitimate business engaged in similar data collection to what Google already does. ...The same author who published an extension (in the Chrome Store) for YouTube

Privacy Policy

The creator of "Twitter 'Likes' Hider" has zero interest in tracking you. Your privacy is sacrosanct. No data will be kept, tracked, transferred, sold, traded, nor even coveted in any respect, from now until the end of time.

From: victoria@monetization-providers.com

Subject: Monetise Your Chrome Extension

I came across your extension on the Google chrome store and wanted to reach out to you to offer a way to increase revenue earnings from your extension. We are providing our partners with Bing landers and feeds that pays really well on extensions for search. It can earn up to $800 a month per 5000 users, and it is a premium product by invitation only. If your extension does not have search this is not a problem with a simple update this can be added, furthermore it is completely acceptable by google chrome store.

If this is something you would be interested in, I would be glad to schedule a call to discuss this with you! Also if you are looking to sell your extension we can discuss this opportunity as we buy extensions.

Victoria Jude

Business Development Manager

The sending domain was registered yesterday.

90% are just bots and automated attacks

This is what capitalism looks like, folks. Someone "built it" so they now privately "own it", no matter how big it gets. It's not put into the hands of an organization. The profit motive is quite strong, which is why someone can be "corrupted" by very tempting messages like this. If you had a lake or a forest privately owned by one or two people, and they had a lot of debts, they could easily sell it to polluters and loggers.

Some people scoff and say "socialism has been tried, it never works." I admit that socialism simply trades one class of elites (the capitalists with a lot of shares) for another (the bureaucrats with a lot of political clout). BUT! I would like to say that socialism is not the only alternative. The other alternative is decentralized systems with no private ownership. I'm talking about science, open source software, and so on. There can be a Merkle tree of version updates (e.g. git version control) and each one can have various reputable organizations (like Zagat for software) building their reputation vetting it. Then, each community would run their own app store (think Wordpress plugins) which would work with these reputable organizations. There would be no heroes, no celebrities, no tweets at 3 am to 5 million people, no pulling from repos without peer review, no scientists instantly believed after publishing on arxiv.org . Congratulations for building a popular extension. You live in a world where you it's really bad to "criticize the profit", and where building it means you are responsible for it no matter how big it gets, but then we are all depending on your integrity and ability to rebuff life-changing amounts of money to not mine our data. We can pass laws to punish people after the fact, or we can gradually change our culture by rejecting "immediate gratification" of updates that are not vetted, just as corporations have done with bleeding edge vs stable Linux distros etc. Unfortunately, the Web has made it so that anything can be updated at any time, with no sysadmins or reviewers in the loop. It's a wonder more malware isn't silently everywhere already.