8m Users' AI Conversations Sold for Profit by "privacy" Extensions

Or they'd tell WhatsApp to allow granting microphone permissions for one single call, instead of requesting permanent microphone permissions. All apps that I know of respect the flow of "Ask every time", all but Meta's app.

Google just doesn't care.

The developer documentation is actually pretty clear about this: https://developer.apple.com/documentation/bundleresources/ch...

The NY address is a virtual office.

https://themillspace.com/wilmington/

The DE address is a virtual office plus coworking facility.

If that looks use-italics "really legitimate" to you, then you might be easily scammed. I'm not saying they're not legitimate, but nothing that you shared is a strong signal of legitimacy.

It would take a perhaps a few hundred dollars a month to maintain a business that looked exactly like this, and maybe a couple thousand to buy one that somebody else had aged ahead of time. You wouldn't have to have any actual operations. Just continuously filed corporate papers, a simple brochure website, and a couple virtual office accounts in places so dense that people don't know the virtual address sites by heart.

Old advice, but be careful believing what you encounter on the internet!

> This company has been on researchers' radar before. Security researchers Wladimir Palant and John Tuckner at Secure Annex have previously documented BiScience's data collection practices. Their research established that:

> BiScience collects clickstream data (browsing history) from millions of users Data is tied to persistent device identifiers, enabling re-identification The company provides an SDK to third-party extension developers to collect and sell user data

> BiScience sells this data through products like AdClarity and Clickstream OS

> The identical AI harvesting functionality appears in seven other extensions from the same publisher, across both Chrome and Edge:

Hmm.

> They look really legitimate on the outside

Hmm, what, no.

We have a data collection company, that thrives financially on lack of privacy protection and the indiscriminant collection and collating of data, connected to eight data siphoning "Violate Privacy Network" apps.

And those apps are free... Which is seriously default sketchy if you can't otherwise identify some obviously noble incentives to offer free services/candy to strangers.

Once is happenstance, twice is coincidence, three (or eight) times is enemy action.

BiScience is an Israeli company.

1000 N. WEST ST. STE. 1501, WILMINGTON, New Castle, DE, 19801

It almost matches this law firms address but not quite.

https://www.skjlaw.com/contact-us/

Brandywine Building 1000 N. West Street, Suite 1501 Wilmington DE 19801

I spend a lot of time trying to think of concrete ways to improve the situation, and would love to hear people's ideas. Instinctively I tend to agree it largely comes down to treating your users like human beings.

There are honest ways to make a living. In this case honest is “being transparent” about the way data is handled instead of using newspeak.

That's why TLS exists, after all. All Internet traffic is wiretapped.

VPNs are just one example. How many chrome extensions do you have that you don't use all the time, like adblockers, cookie consent form handlers or dark mode?

but other than that I would never trust anything other than Mullvad/IVPN/ProtonVPN

Meanwhile reputable VPN provider like mullvad offer there service without KYC and leave feds empty handed when they knock on there doors.

https://mullvad.net/en/blog/mullvad-vpn-was-subject-to-a-sea...

Or you mean the web sites packed with a copy of chromium?

Often they're compiled with typescript etc making manual review almost impossible.

And if you demand the developer send in the raw uncompiled stuff you have the difficulty of Google/Mozilla having to figure out how to compile an arbitrary project which could use custom compilers or compilation steps.

Remember that someone malicious wont hide their malicious code in main.ts... it's gonna be deep inside a chain of libraries (which they might control too, or might have vendored).

That means they support those that breach your privacy with non-malicious intent.

I think we need both human review and for somebody to create an antivirus engine for code that's on par with the heuristics of good AV programs.

You could probably do even better than that since you could actually execute the code, whole or piecewise, with debugging, tracing, coverage testing, fuzzing and so on.