My browser, the spy: How extensions slurped up browsing histories from 4M users

'When we use browsers to make medical appointments, share tax returns
with accountants, or access corporate intranets, we usually trust that
the pages we access will remain private. DataSpii, a newly documented
privacy issue in which millions of people’s browsing histories have
been collected and exposed, shows just how much about us is revealed
when that assumption is turned on its head.

DataSpii begins with browser extensions—available mostly for Chrome
but in more limited cases for Firefox as well—that, by Google's
account, had as many as 4.1 million users. These extensions collected
the URLs, webpage titles, and in some cases the embedded hyperlinks of
every page that the browser user visited. Most of these collected Web
histories were then published by a fee-based service called Nacho
Analytics, which markets itself as “God mode for the Internet” and
uses the tag line “See Anyone’s Analytics Account.”

Web histories may not sound especially sensitive, but a subset of the
published links led to pages that are not protected by passwords—but
only by a hard-to-guess sequence of characters (called tokens)
included in the URL. Thus, the published links could allow viewers to
access the content at these pages. (Security practitioners have long
discouraged the publishing of sensitive information on pages that
aren't password protected, but the practice remains widespread.)'

-- source: https://arstechnica.com/information-technology/2019/07/dataspii-inside-the-debacle-that-dished-private-data-from-apple-tesla-blue-origin-and-4m-people/

Cheers, Peter
-- 
Peter Reutemann
Dept. of Computer Science
University of Waikato, NZ
+64 (7) 858-5174
http://www.cms.waikato.ac.nz/~fracpete/
http://www.data-mining.co.nz/
_______________________________________________
wlug mailing list | [email protected]
Unsubscribe: https://list.waikato.ac.nz/mailman/listinfo/wlug