Is my Email Address Being Exposed thru the VDH Extension?

[kwalla23]

Your question

During a period of ~8 weeks, I visited 6-8 websites (home improvement and other similar sites), and as soon as I left those websites, I IMMEDIATELY received an email politely thanking me for my visit (last occurrence was ~ 2wks ago at Legacybox.com). This "freaked me out" as I had never visited these sites before and DEFINITELY DID NOT provide any of these sites with ANY information. I only clicked around their website (maybe about 5 mins.) to view their product(s) and then left (i.e., closed the Firefox [FF] browser tab). Extremely typical web browsing!

VDH is the only extension I have installed in FF, and I only just noticed that my email, same one those sites contacted me at, is in the FF VDH extension (along with the CoApp license key). ((I didn't use VDH at any of those sites.)) Is it possible that websites are seeing my email that is listed in my FF browser / VDH Extension? If so, it would be greatly appreciated if VDH removed it from the browser extension.

Originally reported, ~2 wks ago, over at the Github VDH CoApp Issues page:
[https://github.com/aclap-dev/vdhcoapp/issues/235]

INFO ABOUT ME: I DO know more than basic internet safety (not a noob!). I have NEVER used auto fill and have NEVER saved usernames/passwords AND those functions are turned off in my browsers. Prior to this, I typically only cleared by browser data/cookies at the end of the day, but now do it now almost always after leaving every website before going to another. When these "email leaks" occurred, I wasn't using Firefox Private Browsing (although I do use it). And, yes, I am using private browsing more frequently now, though not exclusively. I've left 2 reports at the Mozilla.org support forum a couple weeks ago with no real assistance or acknowledgement that there is a problem with Firefox itself.

Addon & CoApp version and details

version: 9.1.0.44
target: mozilla
channel: stable
lang: en-US
coapp: {"found":true,"path":"C:\Program Files\DownloadHelper CoApp\vdhcoapp.exe","version":"2.0.19","new_version":false}
license: {"accepted":true,"email":"","key":"1c4ba525175a48b0"}
platform: x86-64 win
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0
{
"valid_license_message_has_been_displayed": true,
"http_media_download_strategy": "inbrowser",
"download_directory": "C:\Users\Dave\dwhelper",
"show_success_notification_for_icognito": true,
"view_options": {
"all_tabs": false,
"low_quality": true,
"sort_by_status": true,
"sort_reverse": false,
"show_button_clean": true,
"show_button_clean_all": false,
"show_button_convert_local": true,
"hide_downloaded": false
},
"open_count_store": 5,
"successfull_dl": 17,
"never_show_successfull_dl_message": true,
"history_limit_in_days": 1
}

[GrampaWildWilly]

I do not work for VDH. I'm just another user.

I have to say I have not experienced anything like what you're describing. As for VDH, it does not need to supply your E-mail address in order to download anything. I use ffmpeg by itself all the time & there is no mechanism for supplying an E-mail address on a download request. I mention that because the download engine inside VDH is ffmpeg.

I suspect it is more likely Firefox itself is supplying the information. In the standard Firefox settings there is a section called Privacy and Security. On that page of settings, there is one called Autofill that has a Saved addresses button. You should click that button & see what's in there. Now, I can't tell you if Firefox offers some API for web sites to query that information without you explicitly filling in a form on the web site. I'm not a Firefox internals geek. I just use the browser.

I would suspect culprits other than VDH in your case. I would, of course, take @paulrouget Paul's word on this subject over mine.

[GrampaWildWilly]

OK. I clicked around Legacybox. Played a video I found on the site. How long did it take before you got an E-mail from them? I suppose I should visit them later with VDH enabled (after the football game).

[kwalla23]

Hey Grandpa,

1. TIMING: Unfortunately, I didn't have my email open when visiting Legacybox.com, so I don't know exactly when they sent their email. But the email came sometime between immediately to maybe 30 minutes after visiting the site as I had checked my email approx. 30-60 mins. after visiting their site. However, I did have my email open when visiting some of those sites where this happened previously... and the email showed up almost immediately (seconds/few minutes) after closing the browser tab.
2. VDH ENABLED/DISABLED: VDH is always enabled in Firefox... never bothered to disable it previously.
3. AUTOFILL: As I think I mentioned I've never ever used autofill and it is turned off. But, as suggested, I did go into the FF settings and the "saved addresses" field is empty.
4. LEGACYBOX: Thanks for indulging me and browsing around Legacybox.com. I would greatly appreciate it if you would give Legacybox another visit, as you mentioned, this time with VDH enabled. I visited their website for maybe 4-7 minutes looking for their current TV commercial deal about converting VHS tapes to digital. Don't recall looking at the video you mentioned, but could have. And, I know I definitely didn't fill out any forms or provide ANY info. of any kind (at Legacybox or at any of the 5-7 other sites that have sent me an email immediately after visiting).
   Thanks!

[GrampaWildWilly]

OK. It's been a day & I haven't received anything from them. I went back just now with VDH enabled. Found the video I found yesterday . . . I think. It seems to be a little promo. I didn't pay it a lot of attention. I note that VDH recognized it, but it was just a straight video, not HLS or anything fancy. The context menu on the video also offered Download video as... so I suppose I could have downloaded it with either VDH or Firefox. But I didn't bother. It was a bit strange, as videos go. There was no player control to pause & restart or adjust volume or anything like that. Just a picture-in-picture icon. I clicked around on 5 or 6 pages & didn't do anything else. I have not had any immediate E-mail from them. I guess this might be too soon anyway. I'll let you know tomorrow. It is very odd that you would have gotten such an E-mail. I don't know what might have informed them -- or any web site -- of your identity if you didn't actually sign up for anything or fill in any forms. Best I can say is it doesn't happen to me. I wish I could say why.

[kwalla23]

Hi Granpa, Thanks for visiting Legacybox with VDH enabled. Glad you didn't bother downloading the video as all my activity at these sites was just been spending a few minutes looking at their product(s) and leaving. I'm certain that if you didn't get an email within a half hour, you're not likely to get one. So, don't bother updating here, unless you do.

Your not kidding it "is very odd that [I] would have gotten an E-mail"! This is really spooky stuff! I wouldn't be bothering you if this only happened once; and would have written it off as very unlikely coincidence. But the 2nd, 3rd times it happened, I was certain there is something is wrong (not to mention the ~6th-8th times). Perhaps if it had been a website I had visited and logged into at some previous time, I would likely credit it to browser fingerprinting (like mentioned at these sites: CoverYourTracks.EFF.org, BrowserLeaks.com). But, again, these were sites I'd never visited previously. I didn't know them and they never should have known me. Yeah, so this is way, way, way, beyond odd!

Just an FYI... None of the other websites ever sent me a 2nd email, although Legacybox did followup with 2 more emails. I've never "opened" any of these emails (or other spam) in the sense that I have my email client set up so any email I get from new sources only shows text and no images; so the new sender's email server gets no notification I've looked at their email.

Thanks for your time... really appreciate the help!

[GrampaWildWilly]

Right about E-mail. I also use an E-mail client that just shows text, not images. If there's an HTML attachment, the only way that opens is if I explicitly tell Firefox to open it. Nothing automatic happens. I do get quasi-spam, plenty of it. Like from Micro Center & Amazon. But those are places I have, in fact, made purchases. So that's to be expected. But I don't get E-mail from anywhere I'm not expecting. I use GMail for my E-mail server (but not for my E-mail client) & I have a filter set to move anything they think is spam to my Inbox. I generally don't trust their spam filter. It usually marks things as spam that aren't & fails to catch actual spam. So I force it to let me decide for myself. I get very little unsolicited, unexpected junk. Maybe one or two a year, maybe less. Everything else is, like a said, quasi-spam, advertising from organizations I have actually done business with. I don't know who might have sold your E-mail address & what spam organization has spread your address around. You're probably going to have to be lucky to figure this one out. It will likely take a bunch of lateral thinking & just plain dumb luck. I'm pretty sure neither VDH nor Firefox is to blame here. It's probably something you did that had collateral consequences you are not at all aware of. In the meantime, I would click those unsubscribe buttons & hope they work.

[jcfrog]

Hi,
One thing for sure: we do not share any private data. And technically I don't see how even a bug could expose your email address.

[kwalla23]

Hey jcfrog,
Thanks for the quick reply! I really hadn't thought that VDH might possibly be sharing private data. Also didn't even suspect that the VDH extension might possibly be involved until recently seeing my email within the settings. But I did want to bring it to your attention in the unlikely case it could have leaked through the FF browser, possibly via the VDH extension. Unfortunately, this incident has happened now too many times to be a coincidence, so I've got to figure the Firefox browser is involved in some way. Anyway, I greatly appreciate your time!