palant

Found it. This is the optOut_crawl setting and its handling is entirely on the server side. So presumably if this setting is set, the server will no longer send the extension any instructions to scrape Amazon pages in background. Mind you, it still could but it probably won’t.

Scraping data from pages you visit shouldn’t be affected by this.

Note: I am the author of the article above.

Nice, I didn’t find this setting and I explicitly went looking for it. So the settings in the “price history” graph don’t merely apply to the way this graph is shown. Now I need to figure out what this setting is doing. Because I didn’t see any conditions in the code which were tied to this setting.

Note: I am the author of the article above.

The history of all Amazon products you looked at or searched for is personal data, and it can tell a lot about you. Whether it is also personal data in the legal sense is not something I can say for sure. But it definitely has to be properly covered in the privacy policy, for GDPR compliance at the very least.

Unfortunately, that’s only your word. The way this system is designed, nobody will notice if Amazon chooses to be less obsessive about it. Or if their systems are hacked. Are you certain that these web services are secure? I’m not (one obvious vulnerability has been reported). If someone compromises one of these services, the results will be disastrous.

Note: I am the author of the article above.

Chrome has this functionality, other Chromium-based browsers most likely as well. But how many users would actually manage access lists for extensions?

The AMO team used to review every submitted add-on. They no longer do, now it just says “This add-on is not actively monitored for security by Mozilla. Make sure you trust it before installing.” on virtually every add-on. They still enforce this policy, but usually only when someone reports an add-on violating it. I reported this add-on, we’ll see now when/how they take action.

Note: I’m the author of this article and a former AMO reviewer.

The whole extension is all about “let’s see when customers go to competition and try to bring them back.” That’s rather shady but it’s exactly the advertised functionality. And I’ve already got the first comment on the blog essentially saying “I don’t care what else they do, this extension gives great suggestions and I love that.” :-)

That’s actually legitimate functionality of this extension. :-)

Note: I am the author of this article.

Yes, you put considerable trust into applications running on your system. But I hope that you don’t just install random applications. You probably choose only vendors where you can reasonably assume that they don’t want to accept the backlash of having shipped a malicious application.

Now shipping a malicious application is always a risk. This application release is evidence of misbehavior, should someone choose to analyze it. This risk is almost non-existent with dynamic web applications. It would have to be the one targeted user who analyzes megabytes of code.

To sum up: there is a good reason why websites are sandboxed and don’t get any access to your system.

Note: I am the author of this article.

If Amazon does track some users of their extension right now, we wouldn’t know. It’s a web service, nobody can tell whether it behaves the same for everyone. It has all the privileges, and I can look into what it does with these privileges in my case, but I cannot tell whether it works the same for you.

Note: I am the author of this article.

Most of its functionality is meant to work on other websites. There is probably little reason to install it for amazon.com only.

Note: I’m the author of this article.

You could also read the article before commenting. It’s one thing when an extension could do something but its code can be inspected to verify that it doesn’t. It’s an entirely different thing if it delegates its privileges to a web service that could do anything and that nobody can inspect.

Note: I’m the author of this article.

Nice research! Was that trick with mutation observers necessary however? If they add a constant noise vector, all you have to do is creating a canvas with known data, then call toDataURL() and compare what you get to the original data?

Because any kind of predictable noise can be easily calculated and removed. And randomized noise that changes on each call can be removed by making the call multiple times and averaging out the values. So a constant noise value isn’t the worst possible idea, as long as it cannot be retrieved of course.

Yes, I’ve been doing this in the past elsewhere. Quite a messy affair, you have to overwrite `Function.prototype.toString` – meaning for all functions, no real way to do it for a single function. And then you have to be very careful because your overwritten functions runs in an environment you don’t control. Not sure whether implementing this in a completely tamper-proof way is possible.

DuckDuckGo Privacy Essentials implement GPC as well, not sure about any other extensions. So ideally it won’t be usable to recognize Privacy Badger, rather a comparably large group of users of privacy solutions. Ideally of course this would be adopted by browsers eventually. Not saying that this necessarily makes it a good idea, we’ll have to see whether this will do more good than DNT.

Fingerprinting works by grouping people. The smaller the group, the better. And the group where values change constantly is bound to be very small.

Your assumption seems to be that these changes won’t be recognized. But they are very easy to recognize, e.g. by grouping the values by IP address. Same IP address but constantly changing random values? Yes, that’s a very reliable fingerprint.

Unlikely. Some of this is very useful functionality being dumbed down, without real workarounds short of scrapping website functionality.

Then you will be the one presenting a new bogus value on every page load – something that makes you recognizable as part of a very small group. As explained in the article, random values are not the way.

It has its own issues: https://news.ycombinator.com/item?id=25375709

It tends to make animations sluggish, see for example https://github.com/framer/motion/issues/441. That’s not because they are trying to track you but simply because requestAnimationFrame (which has its legitimate uses) can potentially be used for fingerprinting. No regular user is going to make the connection between broken functionality and this setting, and I’ve seen developers waste lots of time on this.

…which has its own track record of subtle website breakage, something that is difficult to notice and impossible to mitigate short of disabling this globally. Don’t get me wrong, it’s nice that this exists, but it’s disabled by default for a reason. There are no silver bullets here.

Note: I am the author of this article.

Note: I’m the author of the article.

I know, the solution presented there isn’t perfect. But IMHO it’s as close as it gets, and it should be sufficiently advanced that detection should be complicated due to differences in browsers and extensions.

I am the author of this blog post. It’s a very detailed description of the issue, so feel free to read only the “Why you should care” section. Also, let me know if something needs clarifying, I’ll see your questions here.

They don't. Mozilla at this stage is still a very idealistically motivated organization. Most people are trying hard to do the right thing. It's merely that real-life constrains often lead to rather suboptimal results, despite all the good intentions.

Yes, I realized that. I probably misunderstood the user who reported this.

I actually updated the article today to address this very line of thought. You can see the added text here: https://pbs.twimg.com/media/EgzgXUAXgAEkp-y?format=png&name=...

It's not that I question the intentions. It's rather that, especially given the execution so far, I have my doubts about what these intentions will lead to in practice.

I doesn't say “grim” because you personally cannot circumvent the restrictions, it says so because of the impact this is going to have on the add-on ecosystem. Your trick isn't going to do you any good if nobody is developing/maintaining add-ons any more.

Unfortunately, it was neither. However, I'm being told that Firefox Nightly allows you to install any add-ons, so maybe running it would be an option.

I actually used the debugging functionality to install a temporary add-on. This is a supported scenario, but it isn't exactly easy to set up.

According to some Mozilla people, this part is actually wrong and extension support is indeed not implemented completely. It's merely that I couldn't (and still cannot) find a list of outstanding issues, and everything I tried worked correctly.