Saturday, May 23, 2015

Is Diigo One Big Data Dump

Not so fast.

I have refused to use Diigo for the past year because of security concerns. Recently all of Diigo's extensions were pulled from the Chrome Web Store. Many are waiting for the Diigo extensions to be back, but should they.

In 2012, Diigo was taken offline for roughly 50 hours  It turns out a domain hijacking took place and Wade Ren, the co-founder, had to pay the ransom to get the domain back.  On the Diigo site there is no reference to Ren, only Joe Liu as a Diigo co-founder.

In the past year there has been various references to Diigo extensions carrying spyware.

On August 25, 2014 Chris Anderson wrote a post on Quick Note, a Diigo extension. He found that was called everytime he went to a website. After a bit of investigation he found the culprit was Quick Note. Every time he visited a website that information was being sent to a third party server.

There have been similar concerns with Diigo's Awesome Screenshot. In April 2015 Ghacks had an article on how Awesome Screenshot fed niki-bot urls, and maybe session data, in plain text from the user's browser history. Diigo updated the extension requesting to capture anonymized click stream data.

Security Stronghold lists instructions of how to get rid of the diigo.dll malware from Windows machines. When Diigo is installed as free software it places diigo.dll and sometimes creates a startup key by the same name. Shortly afterwards ads, popups, and banners begin appearing on the browser and computer.

On May 15, 2015 all their Chrome Apps were pulled by Google.

While the spyware and malware seem bad enough, there are other reasons to be cautious about Diigo.

Around September 2014, Joel Liu begins posting on the Diigo blog instead of diigo. On his Diigo profile page he is listed as the Diigo co-founder. There is no mention of Wade Ren anywhere on the site. Around February 2015, Joel Liu mentions mentions Diigo won't be blocked (from China) with Amazon because of IP chosen.

Yukun Wu complains Chinese users can't access Mendeley but Diigo can, because of GFW?. Many Chinese nationals want access to services like Mendely and Diigo but are blocked because of censorship in China. It looks like since February 2015 Diigo is accessible from mainland China, but is that good or bad and what is GFW.

GFW or Golden Shield Project is known as the Great Firewall of China. Since most Amazon Cloud IP addresses are blocked by GFW (in China), Joel Liu using one could be a red flag. 

Diigo's blog and Twitter has been silent since May 15, 2015. Many users who depend on the service have not been able to use their Chrome extensions. Diigo has millions of users with ten years worth of data, now this would be a data goldmine for the Chinese goverment, or one closer to home.

No comments:

Post a Comment