News for hackers. Stuff that matters.
Re:Mozilla stops distribution of WOT addon by pfg on Friday November 04, 2016 @09:06AM (#12872215)
This begs the question: Where do you draw the line between "data logging" and submitting the URL (or domain, I'm not certain on what level WoT would normally operate) to a server in order to get its reputation? In the end, you can't be certain what the backend does with the data just by looking at the extension code. If you go too far with a rule like that, you'll likely block a lot of legitimate and useful extension. If all you ask for is the word of the extension developer that the data won't be used in this fashion, that probably won't change much in practice.
Re:Mozilla stops distribution of WOT addon by onli on Friday November 04, 2016 @09:26AM (#12872330)
Currently, facing this abuse, I'd completely forbid data transfer from an extension to a server by default. Then add exceptions: If the transfer is necessary for the legitimate function of the extension (note: It is not for stuff like adblocker, where the lists are already cached locally), allow it under special control as long as the data sent out is anonymized as much as reasonable. URLs for example should be hashed before going out.
Re:Mozilla stops distribution of WOT addon by admax88q on Friday November 04, 2016 @10:56AM (#12873051)
> URLs for example should be hashed before going out.

That doesn't help at all. If the server has a database it's going to match this hash too, then it knows what URL corresponds to the hash.

Re:Mozilla stops distribution of WOT addon by onli on Friday November 04, 2016 @11:29AM (#12873332)
It prevents the server form matching the url when it has stuff like the session id and username in it, and also helps in not giving those information to the outside.
Re:Mozilla stops distribution of WOT addon by r721 on Saturday November 05, 2016 @08:58AM (#12879570)
Yeah, Google Safe Browsing ships a local database of urls to prevent this:

https://developers.google.com/safe-browsing/v4/update-api

Re:Mozilla stops distribution of WOT addon by codedokode on Friday November 04, 2016 @09:19AM (#12872283)
The line should be drawn in a court.
Re:Mozilla stops distribution of WOT addon by onli on Friday November 04, 2016 @09:27AM (#12872345)
Though what happened here is already forbidden. It is just very difficult to use the law against those criminals. That is why the browser makers are in a better position to control this.