Seriously.. It’s only sane to code these type of applications to ignore URLs loaded via https.

Kevin

As for Cocomment, if they are pulling the content from every page back to their site — they should be at the very least disabling this for any ‘https’ sites. And/or Firefox/IE should be disallowing this — or notifying the browser user that a plugin is sending this information back to a plugin. Imagine how much spyware/toolbars are doing this in browsers for the tech non-savvy.

I believe it’s a generic warning from Citibank. It wasn’t triggered by anything present in my browser - I tested this by going back with BlogRovr unloaded, and also with a vanilla IE7.

That said, something prompted them to display this warning: perhaps it was the very well documented case by @7 John Ratcliffe-Lee above… or others. So let’s forget BlogRovr, coComment ..etc for a while.

I believe what we have here is a generic question: when we use any browser extensions that track the content of web-pages, how do we know we are safe?

I’d love to get whoever put out the warning on Citibank’s site engaged … fat chances But perhaps the coComment team will chip in here?

I hate when you use the word “whilst”

I want to punch you.

I would check into what is going out to them, but I don’t have time for it.

But when you think, would Yahoo do something like that for legal issues?

Don’t forget MyBlogLog is a bit*** to Yahoo now

This isn’t Citibank’s security hole, it’s CoComment’s. If you install the Firefox plugin for Cocomment, Cocomment’s javascript is fetched from their server and executed on every page your browser loads. The referrer from the fetch tells Cocomment the URL of every page you visit, and you’re allowing them to run arbitrary Javascript on that page, so I hope you trust them completely with any and all information you view on web pages.

Anyway, when the Javascript runs, it’ll try to identify forms on the page, and if you haven’t explicitly blacklisted the site in Cocomment, it will do its best to put any form submissions you make into your Cocomment feed. This is what Cocomment is for, after all.

Why are Cocomment doing it this way? I suppose that fetching the script from their server each time means its always up to date, so if they change it to recognise a new type of blog, you’ll see that working straight away rather than having to update the extension. They also need to know every page you visit because they’re also providing this “review/comment on any web page” function (where they store the comments on their server and you can see them when you visit a page). I think other people have tried that idea and found no-one cares, so for my money Cocomment would be better off sticking to what they’re good at.

How could they make this better? Well, pages which aren’t publicly visible without a login shouldn’t even have Cocomment’s script running on them, at all, ever. The extension should check this and not even fetch the script (it’s the fetch which gives away the URL, remember). Secondly, there should be the option of storing the blogs you want Cocomment to work on client-side, so that running the script is explicitly opt-in for a particular blog.

For now, I’m just using Cocomment’s bookmarklet instead, as I can use that when I want to record a comment (and give Cocomment explicit permission to see the page) and be left alone the rest of the time. This is annoying as I sometimes forget to use the bookmark, so I might get around to doing a whitelist with Greasemonkey if I get a moment.

# Zoli Erdos | November 19th, 2007 at 11:35 pm

“Citi does not test for the presence of browser extensions: I just went back and tested it after uninstalling BlogRovr, then again with a vanilla IE7 and saw the same message, so it’s a generic warning.

“This was at citicards.com, trying to send a customer service message, but I suppose the same situations applies to any site that offers message boxes.”

BlogRovR isn’t looking at or recording anything like this.

http://jratlee.tumblr.com/post/189652

&

http://jratlee.tumblr.com/post/266136

Some of the links in those posts and others you’ll find online might point to “journal.ratcliffe-lee.com” as the domain. I’m in the middle of changing things around and if you point it to “jratlee.tumblr.com” instead, it should work.

Tom Biro also has more here:

http://www.openthedialogue.com.....ibank.html

http://www.openthedialogue.com.....wup_2.html

http://www.openthedialogue.com.....tiban.html

http://www.openthedialogue.com.....ibank.html

Cheers,
Todd

Ian
Product Manager, MyBlogLog

Cheers,
Todd