Mozilla Drops Onerep After CEO Admits to Running People-Search Networks

https://krebsonsecurity.com/2024/03/mozilla-drops-onerep-after-ceo-admits-to-running-people-search-networks/

by todsacerdoti • 2 years ago

327 131 2 years ago

cbsmith8• 2 years ago

I get the concerns about conflict of interest, but I can get behind the CEO's point that their expertise in the space helps them to build better defenses.

abhorrence• 2 years ago

Couldn’t you make a similar argument about protection rackets? Their experience shaking down places for money helps them build better defenses against it, right?

cbsmith8• 2 years ago

You could, particularly since protection rackets actually do compete with each other. I wouldn't want to hire a criminal, but if someone did, they'd likely be effective.

AdmiralAsshat2• 2 years ago

Except the CEO still operates Nuwber. It's hard to believe he's learned from his mistake if he's still actively helming said mistake.

Drakim• 2 years ago

Yeah, I'm 100% for forgiving and giving people a second chance. It's no different than a black hat hacker becoming a security researcher.

But there is a clear conflict of interest if he is still actively engaging in the dubious behavior.

cbsmith8• 2 years ago

I wasn't saying he has learned from his mistake. I'm just saying he no doubt has expertise.

catchmeifyou• 2 years ago

Or, his expertise from Onerep helps him build a better Nuwber.

munchler• 2 years ago

Sure, let’s put the fox in charge of defending the hen house. He’s an expert on chickens and I’m sure he’s changed his ways!

cbsmith8• 2 years ago

We hire black hat hackers to help with computer security.

jart8• 2 years ago

Frank Abagnale is a good example https://youtu.be/vsMydMDi3rI

giuseppe_petri• 2 years ago

"An old poacher makes the best gamekeeper."

int_19h• 2 years ago

Per TFA, the guy is literally running ads for Onerep on his people-search platforms. His "business" is pure unadulterated blackmail.

refulgentis2• 2 years ago

quick note, after I almost did: Please don't feed the trolls: they're replying to every. single. reply. with more bait.

cbsmith8• 2 years ago

Fair advice.

StressedDev• 2 years ago

Good catch - I have noticed that Mozilla gets a lot of unjustified hate and criticism. Does Mozilla make mistakes? Yes. Does it do a lot of good? Yes. Does it deserve the abuse it gets online? Absolutely not.

arp2428• 2 years ago

I kind of agree, but there does need to be a baseline of trust, and that's rather difficult to give when they're operating both types of services at the same thing.

If it had been "I have worked on identity-selling services for 15 years, saw it wasn't a good thing, and now I'm trying to fix the problem" then okay, fair enough. This is something we can at least start with. but this doesn't seem to be that.

AdmiralAsshat2• 2 years ago

I think Mozilla's heart was in the right place here, but pretty disappointing that they didn't vet their partner more thoroughly than what some GMU grad students were able to uncover.

Also makes me wonder what other shady connections fellow services might have, waiting to be uncovered. Looking at you, popular podcast sponsor, DeleteMe!

IntToDouble2• 2 years ago

Puzzling they chose to partner with Onerep when Kanary was part of Mozilla's incubator and is just a fundamentally stellar service.

ckozlowski• 2 years ago

Can you share more?

throwanem• 2 years ago

"Puzzling" is a good description of just about every business decision Mozilla has made over at least the last decade.

People complain about the Google search deal and I get why, but I've been using the browser since back when it was called Phoenix, and at this point I'm pretty sure the Google deal is the only reason it's still alive. The engineering is still solid; its stewardship seems anything but.

donmcronald• 2 years ago

Also makes me wonder what other shady connections fellow services might have, waiting to be uncovered.

This is why it's so important to require disclosure of beneficial owners for all companies. The world is filled with people that will poison you just so they can sell you an antidote, or, better yet, life long treatment.

jqpabc1234• 2 years ago

... pretty disappointing that they didn't vet their partner more thoroughly

Kinda like partnering with Google while promoting Firefox as the "privacy browser".

arp2428• 2 years ago

I assume you're referring to the default search engine deal? What influence does that have on Firefox's privacy features? How does it make Firefox not a "privacy browser"?

wolverine8762• 2 years ago

pretty disappointing that they didn't vet their partner more thoroughly than what some GMU grad students were able to uncover

What did it take for them to uncover it?

Generally speaking, GMU grad students may have have more time and plenty of expertise. When those grad students leave school and get jobs at Mozilla, they may be too busy to go down rabbit holes looking for long shots.

slvrspoon• 2 years ago

Co-founder DeleteMe here. Been building and delivering privacy tools and chatting on HN for 15 years. Happy to answer questions but please easy on unfounded accusations :)

SpaceManNabs• 2 years ago

I thought people were being ridiculous when they were angry at mozilla for bundling with Pocket. After this, maybe the slope was more slippery than I thought.

wolverine8762• 2 years ago

How would this situation indicate a slippery slope of decision-making? Mozilla didn't know about OneRep's CEO's history; nobody did until Krebs uncovered it.

criddell• 2 years ago

It goes back many years before Kreb’s wrote about it. Optery has a nice write up of the situation here:

https://www.optery.com/optery-statement-following-investigat...

krebsonsecurity• 2 years ago

Their earlier statement said they were aware of the CEO's history but were assured that part of his life was behind him. From that statement on March 15: “We were aware of the past affiliations with the entities named in the article and were assured they had ended prior to our work together,” the statement reads. “We’re now looking into this further. We will always put the privacy and security of our customers first and will provide updates as needed.”

https://krebsonsecurity.com/2024/03/ceo-of-data-privacy-comp...

neilv4• 2 years ago

I suspect that vetting this kind of partnership needs someone who is ferociously knowledgeable, principled, and skeptical. Not someone who's mainly looking at it from a business development or career angle.

Now the aftermath could use a fighter, looking for how they could legally disassemble the entire racket. Not only because it's arguably on-mission, but more importantly because Mozilla has a reputation to redeem on this now.

(For example, no matter how that party has squeaked by wrt consumers, maybe there's a new angle in their dealings with Mozilla, such as a different kind of fraud. And Mozilla is much more able to pursue the matter than most individuals would be.)

myself248• 2 years ago

This. If they can go after the guy for fraudulent misrepresentation or something, I'd be on the sidelines cheering every jab, maybe contributing if there's a legal "attack the stalker companies" fund.

stefan_• 2 years ago

Pursue what? God knows they should pursue building a browser. It’s a simple concept, it doesn’t need ChatGPT-set-to-dramatic words.

Nextgrid4• 2 years ago

Building a browser is harder than posting puff pieces about privacy. Mozilla has sadly strayed away from being a browser company into being some PR company that happens to make minor changes to a browser once in a blue moon.

noqc3• 2 years ago

I like this comment, and I'll pitch in my two cents on it.

Suppose Joe Salesman sells your friend Al a used car and it turns out they got a bad deal, the car was a lemon. What lesson should be learned from this?

a) This was an honest mistake. We expect this kind of variance in used vehicles, and the market works out kinks. I should feel comfortable buying a used car from Joe, should the need arise.

b) The information that this car was a lemon was available to Joe, who did not share it with Al because Joe thought Al was a sucker. I am better at diagnosing cars than Al, (or better at reading people), and I should feel wary about buying cars from Joe.

c) Joe only sells lemons, his business model is to rip people off, and there's no way to get a good deal on a used car from Joe. I should look elsewhere to buy a car.

d) This describes the business model of all used car salesmen, I should not buy a used car from a business that sells used cars.

e) This describes all business models when there is information symmetry between buyer and seller. I should not buy anything whose utility I cannot bound from below. (I need a warranty or similar arrangement from the seller).

There are obviously other options here, this is just to illustrate the spectrum of assumed adversariality. There was an article on HN recently declaring that salesman were more likely to get ripped off. I think this is because salesmen tend to think the answer to this question is (b) because salesmen exclusively interact with people who think that the answer is either (a),(b), or (c).

It's not just salesmen, actually. I think the phenomenon is equally well represented in people with business degrees. The core belief of an MBA is that you can subvert the regulatory structure, and people's psychology, to get them to give you more money for the thing than it costs you to make the thing. That's after all, where MBA income comes from. I think this comes much more naturally to people who think that the answer to the question above is (b).

I think by and large, whenever you hear that their company decided to purchase anything at all (but particular some sort of service), your instinct is that the purchaser was a gullible idiot, and that things would obviously work much better if no one was allowed to buy anything.

Personally, I do not think that ferocious skepticism is necessary to solve this problem. I think that it is much more cheaply and easily solved by having a moratorium on buying shit. Mozilla does not, EVER, need to be a customer.

neilv4• 2 years ago

Mozilla does not, EVER, need to be a customer.

Does Mozilla still need to be the seller or partner in deals with commercial entities (e.g., Mozilla getting paid to be the default search engine or LLM within the browser UI)?

If so, would ferocious skepticism within Mozilla be appropriate in vetting and monitoring those deals?

cooper_ganglia• 2 years ago

Talk about hedging your bets!

micromacrofoot5• 2 years ago

I used OneRep for a few years and it did what it advertised, but that's certainly shady as hell and I'm glad I stopped using their service.

Are there any more trustworthy alternatives? data brokers are scum.

beyondd3• 2 years ago

For an alternative, take a look at Optery (YC W22). We've been flagging the situation at OneRep for years and put a statement out following the Krebs article (link below). We launched to the public as a Show HN in 2021 and as a Launch HN in 2022. Full disclosure, I'm one of the Optery founders.

https://www.optery.com/optery-statement-following-investigat...

michael9423• 2 years ago

What do you think about Kanary?

eaurouge• 2 years ago

Why don't you ask Google to remove pages, while you wait for the perpetrators to honor your page removal requests? I believe Google recently added tools to make this possible.

kanary• 2 years ago

I'm the founder of Kanary. We received a grant from YC in 2018, and have been growing our privacy service since then.

I see a few of our members commented on this post already, so I'll let them speak to the trustworthiness / impact of our work.

You can also read up on us on reddit r/kanary or r/privacy where myself and the team post updates. Reviews like PC Mag are fine, but that one is almost a year old and includes the bias of the reviewer - if you're on hackernews, you know how much software can change in a year.

tjames70002• 2 years ago

I co-founded easyoptouts.com a few years ago because all of the existing options were way too expensive. We focus on publicly-accessible people-search sites. Our customers are happy, and you can check out our privacy policy to see how we handle data.

ds• 2 years ago

All the existing databroker remover tools are flawed because they make use of manual labor to remove you from sites, primarily done by people in third world countries.

We @ https://redact.dev are working on a pure software mechanism for doing these optouts directly from your own device. We already have full mass deletions for over 40 social media and utilitys.

mgiampapa• 2 years ago

This explains some trends where posts are being edited on Reddit with nonsense then deleted. Personally, I think this kind of behavior makes the web poorer as a knowledge base. Yes you have a right to do it with your own content, but doing it at scale makes the internet a less useful tool and it makes me a bit sad since the scrapers will already have the data anyway.

Brian_K_White• 2 years ago

Hopefully it just makes sites remove the ability to edit or delete things once they've been published. Especially forums where things have been referenced by other things.

As much as I routinely fine-tune and fix up a comment after initially writing, I will happily go back to the old days before such ability became common, in trade for the sanity of references that don't disappear or change meaning after the fact. The typos don't hurt as much as the swiss cheese and schitzo conversations.

dotnet002• 2 years ago

Those are mostly in response to reddit's API changes. By editing the comments before deletion, the archives also get wiped and it takes a bit more effort for reddit to restore deleted comments behind users' backs.

Yes, it makes the web poorer as a knowledge base, but it's in response to companies like reddit ruining the internet by baiting in users, changing the agreement and then trying to keep the content that was written under the previous agreements.

miguelazo• 2 years ago

Many databrokers make it very difficult to remove your info, on purpose, of course. That is why the legit removal providers have to rely on manual labor for some. I'd love to see it fully automated, but I'll believe it when I see it. Last I checked, Optery was removing 325+. Best of luck-- you have a long way to go.

Edit: this looks like a totally different service. Mass deletion of old posts is one thing, removing PII from data brokers is another.

shrimp_emoji• 2 years ago

In other words, would you describe your site as the Gillette razor attachment mechanism of online data deletion?

vohk• 2 years ago

I really dislike the trend of making everything a subscription service. I can imagine a niche market that wants to continuously delete content older than an arbitrary window but isn't this the sort of service that most users would need only need sporadically?

The pricing seems to implicitly acknowledge this: $35/m billed monthly vs $8/m billed annually! Would you really expect anyone to intentionally renew monthly? I can't argue that people forgetting to unsubscribe pays the bills, but as a business model it leaves a bad taste.

micromacrofoot5• 2 years ago

Data brokers are like the hydra, one goes down and another 2 new ones pop up. It's a lot of work to keep on top of deletions if you want privacy.

stainablesteel• 2 years ago

that's not actually a flaw

a real flaw is that companies in this niche are actually centralizing data to re-sell while adding a new line in the dataset that says "wanted to remove their data footprints"

tjames70002• 2 years ago

easyoptouts.com, which I work on, doesn't use manual labor - everything is automated! It's definitely important to avoid giving more people access to the data.

edit: and as a result of automation, our prices are also way lower than most similar services

johnea• 2 years ago

I definetely wouldn't want Mozilla to support people-search organizations, but I also wonder if that's really happening here.

I have to believe the expertise gained in people-sesarch would be exactly the expertise one needs to remove people from the roles used by those organizations.

The real question is whether or not there is data brokerage out of Onerep.

This seems like a triumph of optics over substance...

toyg• 2 years ago

It's not just experience, the guy is still invested in a company that does the Bad Stuff. He's playing both angles.

citizenpaul2• 2 years ago

I've had to make the hard acceptance that privacy is absolutely irrevocably dead. Anyone with power or money can now find out not only anything about you but likely even more than you know or realize about yourself. Who has time to do a through documented introspection of every aspect of their own life and actions regularly. Along with every possible connection that this also leads to? No one.

Unless there is massive senate/house/pres unification on absolutely crushing the endless disgusting behavior of spying on people to diminish them and enrich yourself is made illegal WITH CONSEQUENCES. Nothing will change. This will never happen because the US gov is the both the biggest customer and purveyor of these services.

Mozilla is basically the last place that even gives lip service to privacy and they are in bed with this guy. That is how hopeless the situation is.

jart8• 2 years ago

Anyone with power or money

Data brokers post a lot of your PII on the clear web for free. It doesn't cost anything to find out someone's names, the address of every place they've lived, the names of their family members, etc.

citizenpaul2• 2 years ago

That is also true. Though that info is less reliable much of the time. I search myself every now and then and most of those sites are just plain wrong about me.

reilly3000• 2 years ago

What a win for internet journalism.

is_true2• 2 years ago

Wow, this kind of companies should be nuked. I cannot wait the EU to notice this problem.

petesergeant• 2 years ago

At least as scary are the companies (company?) who allow you to do a facial recognition search over the entire crawlable web.

is_true2• 2 years ago

Yep.

Sephr3• 2 years ago

I would only trust a tool for sending mass opt-out requests to every company that I've interacted with if it was free and open source. Even with good intentions, commerce becomes yet another tracking instrument.

jart8• 2 years ago

Not possible. Open source code doesn't have limited power of attorney. Data brokers would also read its code and thwart whatever logic it uses to fill out forms.

Sephr3• 2 years ago

You have power of attorney for yourself. Open source tools can run on your own systems and represent you.

codehalo• 2 years ago

Svd Cfg DC as c

hayst4ck• 2 years ago

If company A creates a problem that company B is paid to solve, then company B benefits when company A is able to make the problem bigger. Therefore Company A and company B both have a vested interest in the problem continuing to be problematic. Both are in a symbiotic relationship that allows them to both extract a profit while providing no net benefit to society.

This is rent-seeking (https://en.wikipedia.org/wiki/Rent-seeking). Rent-seeking is an economic drag and ethically indefensible.

Regulation is how this problem gets solved and it's the only way it gets solved.

croemer• 2 years ago

Protection racket...

BLKNSLVR2• 2 years ago

There was an article on HN recently about government agencies (but also applied to private companies) that are setup to solve problem X and often evolve to, not necessarily causing it, but making it harder to solve.

Brananarchy• 2 years ago

If it's the one I'm thinking of: the title was about government, but all of the examples in the article were private firms with profit motives. The author implied that government must work the same way as industry, but that's a huge assumption.

The article had no examples of public agencies perpetuating the problems they set out to solve.

BLKNSLVR2• 2 years ago

Finally found it:

Article: https://effectiviology.com/shirky-principle/

HN discussion: https://news.ycombinator.com/item?id=39491863

legacynl3• 2 years ago

But that blog post was wrong an ill informed.

amai• 2 years ago

Microsoft is company A and B in one. They sell you a very unsecure OS and cloud environment. And then they sell you security tools to fix the problems they caused in the first place.

Zuiii2• 2 years ago

In the sprite of ad-block lists, I suggest we create an open list of all known companies that people can easily add to. Information about these shady-ass orgs should be divorced from enforcement against them.

7734128• 2 years ago

Called it.

https://news.ycombinator.com/item?id=39280369

legacynl3• 2 years ago

Yeah but you provided no evidence, no reasoning, or anything else that might have elevated your comment above a mere guess. If you throw enough spaghetti at the wall, some will stick.

noqc3• 2 years ago

@dang, why did this get delisted?

Mozilla Drops Onerep After CEO Admits to Running People-Search Networks

Related Stories