Add-on disabled - browser asking to allow access "your data on azad-extension.co.uk" to re-enable it

[elfulus]

Hi Philip,

Great Tool! I have been using it only once or twice per year to aggregate my amazon data.

However, last time the add-on seemed to have been disabled by the browser stating it would require "new access rights to access your data on azad-extension.co.uk".

Since your privacy section claims otherwise (no data is stored anywhere else than on the local PC), I was wondering what this means. The web page and DNS for azad-extension.co.uk seems to exist, but obviously does not have any public browsable content.

To gain some trust in enabling this "new right", please let us know what it does.

Thanks in advance!
elfulus

[philipmulcahy]

If you are a premium subscriber and run a scrape, the extension sends a web request to a web server that I control. The web request contains (if I recall correctly) the log-in email address used for the subscription, the type of scrape the user ran and the number of rows they got back from that scrape. Implicitly it also contains their IP address and the time. It does not leak any of your amazon account information other than the number of rows you managed to scrape from an unknown year (the year isn’t logged, only the table type: orders, transactions, items etc). Most of that information (in particular the email address) is encrypted using a public key that is deployed in the extension. Encryption happens before the http request is sent, meaning that during transmission it's doubly encrypted (as the in-flight request is also protected by TLS). This means that even if the web server were to be compromised, the users’ data is not compromised. Q: How do you use this data Philip? A: Not much, other than to verify that I can query it. Q: How might you use it?: in other words, why did you make this change? A: Short answer: To counter the dishonesty of a small proportion of premium subscribers. Longer answer: Some premium users, despite all of the words in the sign-up process, persist in signing up, using the extension and then telling their card issuer that they didn’t sign up and that the charge on their card is fraudulent. More than one even asked (more like demanded) for help with getting it working or for additional features such as non-chrome-browser support. Despite this, they claim to their card issuer that they didn’t sign up and have never heard of the extension. The card issuers (in some cases) allowed the chargebacks to go through, which leads to disproportionate costs (even if they block the chargeback, card provider and Stripe handling fees amount to about $40, plus the value of my time). When asked what more evidence I could provide that would increase the number of these chargebacks that are decided in my favour, the card issuers request evidence of usage. Providing evidence of any usage (with dates, times and IP addresses) enormously strengthens the case against a dishonest user. Q: Where is the decryption key kept? A: On my laptop (which itself is encrypted); On that laptop’s backups (again they are encrypted); In the future I may also store the key on a password managed such as OnePassword. Q: Where do you keep the decrypted queries? A: on the same laptop in an SQLite database, that is populated by a script that fetches new log rows from the web server, decrypts them and loads them into the database. It’s not very big, because the number of paying users isn’t that huge and most of them are not using the extension every day - no-one is likely to claim that using it is a recreational activity. Q: What's https://azad-extension.co.uk about then? A: That's the webserver that the extension sends the log row per scrape to. The code that does this is shared in this github project, so you can see what is and what is not transmitted. The permission is needed in order to be able to send queries to that URL. Q: You say "query" but you seem actually to mean "send" A: Yes. The "query" is an http HEAD request. The extension doesn't actually care what the returned headers are - the magic is all in the URL parameters, which get logged by the webserver, so I didn't have to write any custom code to run the webserver. I think most of the above is in the [privacy doc](https://azad-extension.co.uk/privacy.html) - perhaps in a more terse form. If you look at its URL, you'll see that it's the same server as the scrape events are sent to. It doesn't do anything else that I recall. I hope this is helpful and reassuring. Yours, Philip