Privacy issue with recommended Chrome extension

[ea167]

Hello wonderful NodeJS Team,

On the page https://nodejs.org/en/docs/guides/debugging-getting-started/#chrome-devtools-55
you recommend the Chrome extension "NiM".

Please note that this extension requires to share our email addresses to use the extension (as well as the permission "Read and change all your data on the websites you visit"). This requirement was added recently.

I doubt this is GDPR compliant, and the author does not provide a clear justification of why they require such a private information.

IMHO NodeJS should not recommend extensions with such practices.

[fhemberger]

Hi Eric,

thanks for pointing this out. Indeed, the user's email address is sent back every second to Google Analytics: background.js#L112-L113

This is indeed illegal under European GDPR laws.

[june07]

As the author of NiM I would like to provide some feedback.

@ea167 "This requirement was added recently" is not actually true. Please see my blog post written approximately a year ago about this: http://june07.com/foff/.

Along with being highly rated at the Chrome Web Store, NiM has had the support of many in the Node.js community, including Paul Irish of the Chrome DevTools team https://twitter.com/june07t/status/861664828909264896, and Wes Bos https://twitter.com/wesbos/status/839871332280057857, among others.

As far as data (email addresses) being sent to Google Analytics, I'm unsure of how that is illegal?! And I would love to be pointed in the right direction so as to change anything that in fact needs to be changed to conform to any compliance issues.

I've written NiM out of my love for the Node.js language/community and continue to dedicate my time to the project. MUCH more positive feedback has been received compared to negative and I would very much like the link to NiM be re-enstated such that other Node.js developers can also benefit from using NiM as so many others have.

-Respectfully

[thom4parisot]

GDPR is about providing a choice of consent about data collection.

Collecting a data without asking a user its permission breaks this statement.

One way to make it compliant would be to provide a user option (unchecked by default) and to let the user opt in, with a clear indication of what is the information used for (to be sold, to be processed, to send e-mails, etc.).

[june07]

Following some help from several sources including checking some of the larger Chome Extensions and how they are doing things, I think we are compliant. I'm certainly not a lawyer.

https://termsfeed.com/blog/legal-agreements-chrome-extensions/

https://app.termly.io/document/privacy-policy/04164179-f943-4e87-ac8b-5afd0367dc6c#infocollect

So it's clear, that change was just made and I circled it in green to highlight here.

[june07]

@fhemberger Would be great to get some feedback on this.

For the record, I've compared NiM's Chrome web store page with that of 10 different companies, all of whom have items in Google's Chrome web store, FOUR (EBay, Paypal, Walmart, and LinkedIn, of whom are among "10 Global Companies Using Node.js in Production" according to Google. And none of which I would think the Node.js community would have a problem "recommend"ing if that is what it means to add a link on the https://nodejs.org/en/docs/guides/debugging-getting-started/ page.

I have compiled current pictures of all 10 companies’ chrome web store pages, as well as the privacy policy pages for each of the 5 which actually have them referenced, and uploaded them to Google photos (see link below). As far as the other 5, there are a number of valid reasons why they may not have privacy policy links, just as NiM did not, but I don’t want to digress.

https://photos.app.goo.gl/y4TN5dT1JeNbED2KA

I can say with strong conviction that data collected by NiM is minuscule by every measure when compared to that collected by these larger companies. Further, no data has ever been used for ill purposes and will not ever deviate from that found in our new privacy policy (link again: https://app.termly.io/document/privacy-policy/04164179-f943-4e87-ac8b-5afd0367dc6c#infocollect) And again, @ea167’s statement that “this requirement was added recently.” is simply NOT the case as can be determined by reading the GitHub project history.
THIS is where/when the extra permissions were added on Feb 9, 2017, close to 2 years ago. As the removal was partly predicated on that statement, I bring it up again.

I do regret not having a privacy policy in place sooner. To my defense, unlike these larger organizations, I don’t really have spare man/woman power to go around. That said, the focus for me has been on trying to make NiM great for the betterment of like-minded Node.js developers. I should point out that I make zero monetary gain from NiM, and it is a side project for me.

So, if they weren’t before, I believe that all of the bases are now covered. I would like to get the Chrome web store link for NiM back and would be more than happy to submit a PR for such.

Please advise...

-Respectfully to all

[eyedean]

I guess it wouldn't hurt to mention here too that this issue is back -- see #1923 (comment).

Shall we reopen this issue?

[ChALkeR]

@fhemberger what do you think should be done here?

[fhemberger]

Honestly I'm a bit disappointed this issue is back. I thought we came to an understanding here, @june07. And it can't be the job of the website team to continuously check for violations of privacy regulations of third-party tools listed on the website. (as listing could also be interpreted as endorsement of those tools.)

In this case I'm in favor of removing this extension permanently from the nodejs.org website. Thoughts, @nodejs/website?

[june07]

Frederic/All, No changes have been made surrounding this issue as it was resolved way back then. If you look at the code you will see that no changes to any of those parts of the code have been changed and nor would they.

…

On Wed, Jun 12, 2019 at 3:36 AM Frederic Hemberger ***@***.***> wrote: Honestly I'm a bit disappointed this issue is back. I thought we came to an understanding here, @june07 <https://github.com/june07>. And it can't be the job of the website team to continuously check for violations of privacy regulations of third-party tools listed on the website, as this could be interpreted as endorsement of those tools. In this case I'm in favor of removing this extension *permanently* from the nodejs.org website. Thoughts, @nodejs/website <https://github.com/orgs/nodejs/teams/website>? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#1908?email_source=notifications&email_token=ACWT35W3JN4MUNYQIDVNTWLP2DGR3A5CNFSM4GFQXBZ2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGODXP7LFQ#issuecomment-501216662>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ACWT35WKPKNT5QGAN3LWSN3P2DGR3ANCNFSM4GFQXBZQ> .

[sam-github]

I am having difficulty getting up to speed on this issue.

I just installed NiM, it clearly says the extension will have the right to "Know your email address", it doesn't say it will have the right to report it, though this seems to be a technical limitation of the Chrome extension permissions requesting system -- Chrome only knows the extension "knows" the email address, it can't possibly know what the extension does with it.

If the description is expanded and I read far down enough the page, I find:

Further to better serve and understand my user base the following permission is asked
"Know your email address"

This is a fairly vague statement, it doesn't say what is done with the email address to understand the user base.

With such a delicate issue as removing an extension from our docs, I think the history should be more clear so a fair decision can be made. As-is, its too dispersed across multiple threads. Questions I'm left with:

• "I thought we came to an understanding here" - I don't see a sign of any coming to an understanding in this thread
• GDPR violation: its not clear to me that it does violate GDPR
• The chrome extension seems to be clear in at least that it requests permission to know the user's email address, though I didn't see where it was written what it does with that address

[june07]

@sam-github speaking to your bullets

• Per my last comment in the other thread:

And with the help of those on the node teams, including even bringing this to a TSC meeting, I thought I took every applicable action/step to make things compliant

My thoughts further being validated when NiM was finally reinstated.

• It was my understanding that any GDPR violations were fixed (back then) by the above. And again, nothing new has been added to the code to violate GDPR.
• I agree. And by design I think that Google has it's own fail-safe checks in place to ensure compliance to GDPR. By the simple fact that we are talking about a Chrome Extension, that in of itself guarantees some things. Notices are made at the Chrome store. You get a nice popup when you install the extension.