I was approached by Luminati on Twitter to turn my browser extensions into exit nodes, they are enticing developers to exploit users.

https://i.imgur.com/EbT96an.png

This is why these days I roll my own extensions except for a few extremely popular ones developed in the open. Forget small QoL extensions, if I need it I write my own. Malware businesses routinely reach out to any remotely popular extension for acquisitions or “joint ventures”, it’s just too risky to install anything that’s not trust: ultimate, or known to be vetted by tons of people.

Btw, Firefox seems to have made it impossible to run extensions uncrippled from source without uploading to their server for signing. Utter madness.

I was wondering why my extensions weren't loading up even if after I messed with the settings, thank you!

Auto-update of extensions and apps should be set to off by default. There would be less reason for extensions to be bought by other developers for their installed user base.

Secondly, how come there is no regulation about selling chrome extensions and apps?

If you turn auto-updates off, you're just reinventing early 2000s desktop security and attackers everywhere will thank you. Updates need to be automatic but there needs to be stricter rules about notifications to users about changes in ownership or functionality. A huge fraction of this would go away if corporate liability didn't allow hiding all of this in terms of service.

This is said way too often, but in this case I think it's justified - I really don't understand how this is legal. Doesn't using a non-consenting person's computer and network resources for your own purposes meet the definition of "hacking" in most jurisdictions?

It probably isn't legal. But who is going to pay for the fight to stop it? Mom & pop who have had their home connection used? A class action that no one but the lawyers really win anything from? The fact that most of the projects involved are in jurisdictions that make the legal process more complicated and more expensive, or jurisdictions that simply don't care as long as it is affecting other countries and not them (coughChinacoughRussiacoughcough*)?

What the market will bare doesn't just apply to product pricing.

And someone clicking through a EULA might be an argument for them having invited the use of their resources by a very similar argument to that many used to justify using other people's WiFi back when that was gloriously insecure most of the time ("but the AP broadcast its existence, effectively inviting me to join, and happily gave me an IP address to work with, how could I not believe I was welcome to use it?").

I am an administrator on a forum that was attacked heavily by these "residential proxy services"; most of the time the users have agreed to a hidden EULA somewhere like at installation time of the extension buried deep within.

But almost everyone "a reasonable person" would not recognise or understand the technical words used in the disclaimer, nor even read all the way down where it's buried several links in.

On the other hand, if these things get common enough it's great for plausible deniability!

I've never heard such service exists and uses browser extension user's network. It looks horrible. Possibly random browser extension user may arrested by unknown reason.

Thanks for the link. I figured something like that had to be the case. I can't really think of a legitimate way to get access to that many IPs.

I periodically see ads on Kijiji (Craigslist for Canada) offering you 50 bucks for your internet connection. If that is the going rate, 50 million I enormously expensive.

The boxes have the ability to try to DHCP-release-renew your IP to get a new one after being banned for spam/fraud/DDoS/etc.

However, this is not how these residential proxies are sold- mass market ones with millions of IPs are generally botnet/hacked/malware/extension malicious author sellout/etc./ There are not actually millions of botnet user, they just try to make themselves look big. Like they say AT&T has a /8? So they get 1 botnet hacked PC on AT&T broadband and say "wow we have a /8 worth of proxies!!"). Criminals not known for their truthfulness.

The ones that ask you $20-50/m and to plug something into your network is generally used for fraud, account hijackings and maintenance (getting a stable IP for stuff like a credit card checkout or paypal account to use for more than a few days for fraud, long term social media abuse, similar) instead of mass market ban evasion.