An investigation by German public broadcaster NDR revealed that MyWOT (WOT, or Web Of Trust) has been selling user data to third-parties without properly anonymizing user information, which in some cases exposed the user's real identity and details about his browsing habits.
Following NDR's findings, both Google and Mozilla have removed the extension from their add-on portals.
According to the German broadcaster, its reporters were able to get access to a sample that contained ten billion URLs WOT users had accessed.
While WOT claimed it scrambled data to hide the user's identity, reporters said it was easy to identify clues in the URLs that connected the link with a username, email address, or name.
Reporters discovered information about police investigations, a judge's sexual preferences, and user searches for drugs, prostitutes, and medical issues.
WOT claims on its websites that over 140 million users had downloaded and installed the app during its 10+ years history. Ironically, the extension's purpose is to provide information on the reputation of websites that users are trying to access, if they're safe for kids, contain spam, are trustworthy, or don't respect user privacy.
On November 2, WOT put out the following statement on its forum.
We take our users’ privacy rights very seriously, and for that reason we go to great lengths to anonymize and aggregate the data we collect to run our service, and we of course never license or disclose user registration information.
If there have been instances where any information was not adequately anonymized and protected, we will of course look into it and, where necessary, take measures to ensure adequate protection for our users. We appreciate the users who have contacted us and brought this to our attention.
We will continue to proudly protect our users from countless online threats as we have for the past decade.
After the story had started to gain attention in the international press, both Google and Mozilla removed the WOT Chrome and Firefox extensions from their stores on Saturday, November 5.