The subtle point of delegating everything to remote services is your user doesn't need to know when you've modify behavior. If Amazon were to bundle the content, you'd need to explicitly update your extension.
You're delegating to Amazon that they'll continue to respect your privacy (no claims were made they weren't), but also their systems are secure, and will continue to be. This is too much trust to give any entity. No thanks.
From Amazon's perspective, they probably have more than one team working on the extension. A coordinated deployment process at scale is painful. Allowing each team to deploy to its own endpoint and communicate with other components via message passing (events) is exactly how you'd expect a company that grew up on SOA to design.
The AMO team at Firefox used to outright ban addons with remote script injection. I guess it matters who you are -- like on the Apple App Store, big names just need to pull the right strings or call the right people for a free pass. Rules are not applied equally. The playing field is NOT level.
That's true, always has been.
> big names just need to pull the right strings or call the right people for a free pass
I'd be curious if that's the case.
For the most part in B2B, "the rules" generally only apply when the risk of a client doesn't out weight the benefit of that client. T&C and Contracts are always negotiable, it's just a matter of if it's worth it to both parties.
Amazon has more street cred than say, me, as a developer. And Amazon has a lot more to lose from their Add-On doing a bunch of evil things that I would if I decided to do evil things with mine. Amazon is big enough to assume liability for both itself and Mozilla if something goes wrong, I can't.
Note: I’m the author of this article and a former AMO reviewer.
Users weren't pushed to choose one or the other. Both buttons had the same size and color. It was VERY clear that the developers wanted users to make a meaningful, free choice vs. "just click approve".
The benefit for Google was that installing the toolbar made it easier for you to do Google searches, driving usage up.
Edit:
https://searchengineland.com/turning-the-tables-on-the-googl... has a history of these screens, going from the above-mentioned exemplary "please read" screen to an increasing amount of dark patterns.
Note: I am the author of the article above.
For me, it comes down to alignment and value. Amazon stands to lose a lot if they decided to suddenly stop caring about customers, or not take security seriously. And the Internet gets pretty small if your threat model requires zero trust.
Does "privacy" mean Amazon will spy on their customers, but won't share that data further?
I just setup pihole today because it's so difficult to avoid being spied on wherever you go.
And one day I was browsing a web page in safari and boom - it auto-launched the amazon app and opened it there?
That's when I learned about deep linking, where apps can snoop on ios website activity (in safari, in messages, in mail, etc).
[1] https://slickdeals.net/e/14668013-select-amazon-member-earn-...
No, it's not possible to see what Amazon does with this information but it's clear they can do way too much. And, they can change the behaviour at any moment without the user getting notified within these existing wide permissions. At the very least it's very poor design.
For example, uBlock Origin has similar privileges but I doubt the author would bat an eye.
EDIT: I take back my comment :)
I will copy/paste it for you.
"You could also read the article before commenting. It’s one thing when an extension could do something but its code can be inspected to verify that it doesn’t. It’s an entirely different thing if it delegates its privileges to a web service that could do anything and that nobody can inspect.
Note: I’m the author of this article. "
Would it be more accurate then to say it potentially lets Amazon track you? Without the word "potentially," or similar, it makes it sound like they are in fact doing it when you just said it "could."
However I still think the title could be better. There are lots of things that applications "can" do. I put more trust into random applications that run on my system.
Amazon could also mess with the web experience at will and for example hijack competitors’ web shops. Amazon Assistant log with a borg eye Image credits: Amazon, nicubunu, OpenClipart
Mind you, I’m not saying that Amazon is currently doing any of this."
This goes for any browser extension you install if you don't limit which websites it's allowed to read data from.
In both the title and beginning paragraph, the author essentially describes the privacy risks that would apply to any browser extension, but words it in a way that implies Amazon is actively abusing those privacy holes, before finding any evidence for it.
I really wish people would stop giving views to blatantly manipulative and slimy clickbait like this.
Extensions should be disabled by default upon install. If the user wants to use the extension, the user should be able to click on the extension to active it for this specific page for one time only. None of the major browsers are capable of this (so far as I'm aware), so I always have to remember to disable an extension when I'm done using it.
Note: I’m the author of this article.
Or else what is the !#?!% technology hurdle preventing users from making their own lists?
They are by far the most risky thing one could possibly put on a PC. They essentially remove any alleged benefit to HTTPS/encryption or anything of the sort, because they live inside your web browser and have post-decryption access, often to every website you visit and everything you enter into them.
Do not use browser extensions. Ask your IT person to restrict the ability to install browser extensions.
Novelty extensions are a completely different story but I wouldn't go so far as to ban all extensions ever.
Edit: Looks like this feature is present in Chrome/Firefox extensions as well but for all these platforms (Safari included I think), this needs to be implemented in the code itself[1]
[0] https://developer.apple.com/documentation/safariservices/saf...
[1] https://stackoverflow.com/questions/10504239/limit-chrome-ex...
https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web...
WE are implemented both by Chromium and Firefox (with nuances)
Note: I’m the author of this article.
This morning I wanted to find a android app which would help me time exercises, specifically planking.
It should be simple, set up countdown times for front and each side with 5 second breaks in between, playing a tone to let me know when I can move on or I am done with the exercise.
I looked through at least the top 20 apps on the play store and all of them require at least full network access and to run at startup. Many were so invasive as to request location and to be able to record audio and take pictures.
Being able to monetize these apps is an important thing for developers but it is becoming a real problem I do not see getting any better soon.
Did you see the screenshot with the Amazon ad popup obscuring Google ads?
Yeah. I saw that too.
Disclosure: I work for Amazon but not anywhere close to the browser plugin team(s).
Note: I am the author of this article.
Now shipping a malicious application is always a risk. This application release is evidence of misbehavior, should someone choose to analyze it. This risk is almost non-existent with dynamic web applications. It would have to be the one targeted user who analyzes megabytes of code.
To sum up: there is a good reason why websites are sandboxed and don’t get any access to your system.
Note: I am the author of this article.
I believe more than one user would actually manage access lists for extensions but you have asked a really loaded question given that browser users are not being given the choice here.
In my opinion though, "could" is so close to "potentially" in definition that it seems rather pedantic to hinge the entire article and its conclusions on that single choice of word.
Actual Title: How Amazon Assistant lets Amazon track your every move on the web
HN Title: Amazon Assistant lets Amazon track your every move on the web
I should have been more specific.
Note: I am the author of this article.
Disclaimer: I work for Google Shopping, but not the ads part :)
In a similar vein, your reasoning would conclude that white hat hackers are evil as well.
Having the power to do something bad, and doing something bad with that power are not equivalents.
Is it unfair that they received that power? Yes. Does that make it evil? No. Do I trust them? No.
I'm not defending Amazon, I'm questioning your reasoning because I don't arrive at the same conclusion.
Rhetorical question. You already know the answer.
That's not true. The laws vary by state with California being one of the most restrictive but other states like Idaho, Iowa, Montana, Nebraska, New Mexico, and Mississippi having no restrictions at all.
Please don't spread misinformation.