nav search
Data Center Software Security Transformation DevOps Business Personal Tech Science Emergent Tech Bootnotes BOFH

Browsers nix add-on after Web of Trust is caught selling users' browsing histories

Did the users consent to this?

By Alexander J Martin, 7 Nov 2016

Updated A browser extension which was found to be harvesting users' browsing histories and selling them to third parties has had its availability pulled from a number of web browsers' add-on repositories.

Last week, an investigative report by journalists at the Hamburg-based German television broadcaster, Norddeutscher Rundfunk (NDR), revealed that Web of Trust Services (WoT) had been harvesting netizens' web browsing histories through its browser add-on and then selling them to third parties.

WoT claimed it anonymised the data that it sold but the journalists were able to identify more than 50 users from the sample data it acquired from an intermediary.

The journalists added that the browsing histories they obtained also identified information about ongoing police investigations, businesses' sensitive financial details and information which suggested the sexual orientation of a judge.

NDR quoted the data protection commissioner of Hamburg, Johannes Caspar, criticising WoT for not adequately establishing whether users consented to the tracking and selling of their browsing data.

Those consent issues have resulted in the browser add-on being pulled from the add-on repositories of both Mozilla Firefox and Google Chrome, although those who have already installed the extension in their browsers will need to manually uninstall it to stop their browsing being tracked.

Mozilla explained to The Register: "[It] removes extensions from addons.mozilla.org [AMO] when we determine that an extension is violating our AMO Review Policies. We’ve received complaints about the Web of Trust add-on that relate to the transparency of how it operates.

"After investigating these complaints, we have made the determination that the add-on violates our policies."

Mozilla added it was "unlisting [Web of Trust] from our AMO site until the add-on provider corrects these issues".

A spokesperson for Opera told us that the company reviews "all extensions that are submitted to our catalogue manually, which means every line of code is checked, and external, untrusted JavaScript files can’t pass through. This gives our users high protection from extension malware and background data collection."

The spokesperson added that Opera has "no information that the version of the WoT extension in Opera’s catalogue hasn’t been secure, however it’s no longer available for Opera’s users".

The add-on is advertised as being available for a number of browsers, including Chrome, Firefox, Internet Explorer, Safari and Opera. Representatives of the other browsers had not responded to The Register's enquiries as of publication.

Figures on downloads in the UK are unavailable, but the company claims the add-on has been downloaded more than 140 million times. No British users seem to be aware of the add-on's tracking activities. The Information Commissioner's Office told The Register it was unaware of any complaints about WoT, and that it was not something the office was currently investigating.

Although surveillance may be a feature of WoT's add-on, the risk it poses to users' security may be greater. An analysis of its code posted to GitHub by Rob Wu revealed that the add-on was able to execute arbitrary code on any page, including privileged browser pages, although such a functionality had not been abused at the time of Wu's analysis.

WoT Services has not issued a public statement since the NDR broadcast. We will update this article if it responds to our enquiries. ®

Updated to add

A spokesperson for WoT has been in touch to say:

We take our obligations to our users very seriously. It always has been, and remains, our intention to inform our users, clearly and accurately, as to what data we collect from them and how it is used. We never intend to collect or share data which can be used to identify our users, and we have developed extensive data cleansing techniques to ensure our users remain anonymous.

After a review of some of the information recently reported and a thorough investigation of facts and circumstances, we now believe that our data cleaning techniques may not have been sufficient to fully anonymize the browsing data WoT users shared with us. While we deployed great effort to remove any data that could be used to identify individual users, it appears that in some cases such identification remained possible, albeit for what may be a very small number of WoT users. Of course, if the data allows the identification of even a small number of WoT users, we consider that unacceptable, and we will be taking immediate measures to address this matter urgently as part of a full security assessment and review.

We hope to earn back the trust of the community by implementing a set of measures which will ensure that those who prefer not to share their data can easily choose to keep their data private while still participating in the WOT community.

Regarding the relaunch of WoT – we received a notice from the Mozilla store that they were removing our add-on from the store pending answers to certain questions. We decided to remove WoT from the other platforms at our own initiative so that we could have the time to study the feedback we have been receiving and to make appropriate changes.

We are now preparing to relaunch an updated version of WoT which will include the appropriate measures to regain the trust of our users.

The Register - Independent news and views for the tech community. Part of Situation Publishing