Your browsing history may have been sold already

Discussion in 'privacy problems' started by ronjor, Nov 1, 2016.

  1. boredog

    boredog Registered Member

    Joined:
    Feb 1, 2015
    Posts:
    2,499
    "How/where do you do this in Adguard?"

    please look at my screen shots posted above;) paid version plus beta.

    just click on settings scroll to bottom and untick WOT
     
  2. ArchiveX

    ArchiveX Registered Member

    Joined:
    Apr 7, 2014
    Posts:
    1,501
    Location:
    .
  3. Daveski17

    Daveski17 Registered Member

    Joined:
    Nov 11, 2008
    Posts:
    10,239
    Location:
    Lloegyr
    Yes, that's what I was trying to remember, thanks. I know it has different functionality but I've been wondering about it for a while and it might make me feel better after losing WOT lol. ;)

    EDIT: 'Last Updated: January 13, 2012'

    https://addons.mozilla.org/en-US/firefox/addon/vtzilla/?src=search

    Looks like abandonware.
     
  4. avatar

    avatar Developer

    Joined:
    Jan 18, 2014
    Posts:
    1,048
    It is available in AG for Windows and Mac only.
     
  5. Stupendous Man

    Stupendous Man Registered Member

    Joined:
    Aug 1, 2010
    Posts:
    2,859
    Location:
    the Netherlands
    The VirusTotal browser extensions are not abandonware.
    They are simply not updated when there is no need to update them. They just simply work. :)
    The VirusTotal browser extension for IE, VTexplorer, was updated January 2015, "to make it also work for IE11", as the VTexplorer .htm file says. (The .htm file says "2014", but the final version was January 2015. I know, as I was one of the VTexplorer community testers.)
     
  6. Daveski17

    Daveski17 Registered Member

    Joined:
    Nov 11, 2008
    Posts:
    10,239
    Location:
    Lloegyr
    OK thanks for the info. :thumb:
     
  7. Rasheed187

    Rasheed187 Registered Member

    Joined:
    Jul 10, 2004
    Posts:
    17,559
    Location:
    The Netherlands
  8. The Red Moon

    The Red Moon Registered Member

    Joined:
    May 17, 2012
    Posts:
    4,101
    Well how very interesting indeed.
    Selling user data to 3rd parties is hardly something new,correct me if im wrong but is not google in the same sort of practice.?
    Is google services then not to be trusted and banned throughout the internet realm.?

    Hypocrisy in its highest form i think.
     
  9. Daveski17

    Daveski17 Registered Member

    Joined:
    Nov 11, 2008
    Posts:
    10,239
    Location:
    Lloegyr
    I'm guessing Google anonymise the data properly though. Or should I say, I'm hoping they do. :eek:
     
  10. inka

    inka Registered Member

    Joined:
    Oct 21, 2009
    Posts:
    426
    TWB, from our past discussions I expect you realize that I line-by-line audit the code of any extension I install. If the extension code I had audited at that time was designed to telegraph full URLs, I would have been on here (or ghacks.net) screaming bloody murder...

    To the contrary, I've sometimes chimed in (ghostery thread, a couple years back) to counter unfounded (ignorant and incorrect) "accusations" against a given extension. It's kinda frustrating that few (nearly no one) cares to actually read the code involved; instead, we end up with hearsay perpetuated by "my mind's made up, don't confuse me with the facts" folks.

    As for "when might it have started", elsewhere today I read mention that WOT changed away from "open source" a year or so back.
    Really, are they now going out of their way to attempt to obfuscate their js extension code, or ar just no longer maintaining a public repo?
    Anyhow, I clicked over to the repo today and skimmed the code:
    github.com/mywot/firefox-xul


    github.com/mywot/firefox-xul/blob/c2b3100a9dd1f988c8e2e7125333699552f65e0f/content/config.js
    ^--- here you can see how, based on reporter's rep (rookie...platinum), each reviewer's rating submissions are weighted

    github.com/mywot/firefox-xul/blob/c2b3100a9dd1f988c8e2e7125333699552f65e0f/content/stats.js#L122
    ^--- here you can see that installtime can serve as a fingerprint, regardless whether user is logged into mywot.com user account
    (is installtime telegraphed to mywot stats server? I'll leave that to a more-motivated someone to check out)
    (At a glance, looks like it's factored into sessionid, which is telegraphed when requesting the nonce)

    github.com/mywot/firefox-xul/blob/c2b3100a9dd1f988c8e2e7125333699552f65e0f/content/stats.js#L280
    ^--- here you can see (after tracing var this.lnkUrl and url and the call to query() method)
    that the entire URL, plus referrer URL, plus sessionid are among the payload

    So, they've been doing this at least since 2015 and have been doing it in plain view (code posted to github)
    yet "170 million users" (reputed) have been oblivious until now, thanks to .de newssite article?

    funnysad
     
  11. TheWindBringeth

    TheWindBringeth Registered Member

    Joined:
    Feb 29, 2012
    Posts:
    2,171
    Well I don't know how deep the hole goes (I quickly glanced at some source to confirm there was code to phone home URLs and stopped after that), but we are talking about a reputation checking system. Many of which query the cloud and/or otherwise phone home info. So you'd sort of expect that at least *some* users were watching traffic, peeking at source, and/or asking questions about what is sent to the servers.

    To anyone who frequented the WOT forum: were their any discussions about phone home? About WOT sharing information with other parties? Were the changes now being discussed spotted by someone in the past?
     
  12. boredog

    boredog Registered Member

    Joined:
    Feb 1, 2015
    Posts:
    2,499
  13. boredog

    boredog Registered Member

    Joined:
    Feb 1, 2015
    Posts:
    2,499
  14. emmjay

    emmjay Registered Member

    Joined:
    Jan 26, 2010
    Posts:
    1,548
    Location:
    Triassic
    I use Noscript on FF but I was not aware of this ...

    Noscript: One of its features is that if you use the toolbar button's dropdown arrow to display a site's "contributing" domains, you can shift-left-click on a domain and get a list of "security and privacy information" vetting sites' pages for that domain. Web of Trust used to be one of NoScript's default vetting sites .. but not anymore!

    I do not know if WOT was recently removed or not. I also do not know what filters Noscript was using on WOT when they used them as a contributor. I expect WOT identified a lot of websites that Noscript in turn vetted for scripting activity. I do not think Noscript blacklisted sites based on user ratings (IMO ... correct me if I am wrong).
     
  15. plat1098

    plat1098 Guest

    You can still get this ext. on its website and thru cnet, etc, even though it seems to be a hot potato at this time. I hate to say this (and I never used Web of Trust because I never trusted it) but will it be detected as a PUP now by scanners set up for such? Terrible, right? That would be the final straw, the death knell, I think.

     
  16. kls490

    kls490 Registered Member

    Joined:
    Aug 15, 2015
    Posts:
    60
    Location:
    Mid Atlantic Region (USA)
    Just my two-cents FWIW...

    The WOT option is also part of the Firefox Addon, Malware Search, v0.9.4.1. As shown in the attached screenshot, I've un-ticked the box beside WOT, as a precautionary measure.

    Cheers!
    FF - Malware Search Addon containing WOT option.png
     
  17. Stupendous Man

    Stupendous Man Registered Member

    Joined:
    Aug 1, 2010
    Posts:
    2,859
    Location:
    the Netherlands
    Do you mean on the WOT homepage or download page?
    Since a few days there is no longer a download option offered on those pages.
     
  18. plat1098

    plat1098 Guest

    Well you are 100% correct, Stupendous Man. What kind of webpage leaves all the stuff like browser compatibility, mobile app availability, etc on its page but without a download button? Wow......
     
  19. Stupendous Man

    Stupendous Man Registered Member

    Joined:
    Aug 1, 2010
    Posts:
    2,859
    Location:
    the Netherlands
    I can only speculate, but I guess they decided it was wise to pull the download option, but they have hope to fix things, shortly, so they don't want to clear the page.
     
  20. Stefan Froberg

    Stefan Froberg Registered Member

    Joined:
    Jul 30, 2014
    Posts:
    747
  21. Krusty

    Krusty Registered Member

    Joined:
    Feb 3, 2012
    Posts:
    10,241
    Location:
    Among the gum trees
  22. kls490

    kls490 Registered Member

    Joined:
    Aug 15, 2015
    Posts:
    60
    Location:
    Mid Atlantic Region (USA)
  23. Krusty

    Krusty Registered Member

    Joined:
    Feb 3, 2012
    Posts:
    10,241
    Location:
    Among the gum trees
    Nice! Thanks for sharing.

    Now that is what (WoT) I've been waiting to hear.

    ... But questions remain.
     
    Last edited: Nov 7, 2016
  24. avatar

    avatar Developer

    Joined:
    Jan 18, 2014
    Posts:
    1,048
    This is what they should have done in the first place (unless they don't see any other way of supporting development, not involving big-data stuff).

    I've gotta hand it to Ghostery, they do it properly.
     
  25. TheWindBringeth

    TheWindBringeth Registered Member

    Joined:
    Feb 29, 2012
    Posts:
    2,171
    It is sad that the developer of a product/service ostensibly meant, and trusted, to provide its users with security/safety... a developer that proclaims it "take its users' privacy rights very seriously"... will not refrain from selling/sharing its user's data. Not even after being caught in a manner like this and having a chance at true redemption.

    Unfortunately, MyWOT is the type of thing that would likely attract huge numbers of technically weak and sheepish users. Most of whom probably haven't heard of this incident and never will. The type of people who would be likely to overlook the importance of an opt-out setting that is critical to their security/privacy, or refrain from changing such a setting due to a fear that it would break something important.

    I hope parties in the EU, Finland, and/or wherever push for a formal legal investigation into MyWOT, its owners/operators, what transpired, and how things will be handled in the future. Especially their communicated intention to address the sharing of user data via opt-out settings rather than opt-in. Developers in the security, privacy, and other protective spaces must be held to the very highest standards. By all.
     
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.