Adblock Plus and (a little) more
Cyber Security month 2020 - Our questions, your answers! · 2020-11-23 11:37 by Anna Fediaieva
Last month we asked our followers on social media eight questions on IT security and privacy. Here are the results of the cyber security quiz:
Celebrate and share a safer Internet with us today! · 2017-02-07 10:05 by Peter van Dijk
Did you know today is the official Safer Internet Day? No? Well, now you do! Today is about celebrating all the accomplishments we have achieved in the past years to make the Internet a better and safer place for everyone.
Adblock Plus and the canvas fingerprinting threat · 2014-07-23 12:21 by Wladimir Palant
ProPublica recently wrote about canvas fingerprinting which supposedly has even more significant privacy implications than cookies. And the worst of it: unlike cookies, canvas fingerprinting cannot be blocked by Adblock Plus!
Those of you who know Adblock Plus are probably saying now: “What, Adblock Plus can block cookies? I never knew that!” And you are right of course — Adblock Plus doesn’t block cookies. So, what is this canvas fingerprinting and what does it have to do with Adblock Plus?
Google Chrome and pre-installed web apps · 2011-11-15 09:47 by Wladimir Palant
Google recently launched a redesigned version of its Web Store where one can install extensions and web apps. One particular feature caught my attention: it marks the extensions that you already have with a check mark. How does the web page know which extensions you have installed?
Details on the resolved Adblock Plus for Chrome security issue · 2011-08-17 12:55 by Wladimir Palant
Adblock Plus 1.1.4 for Google Chrome has been released today and fixes a minor security issue. This blog post provides some details.
Finding security issues in a website (or: How to get paid by Google) · 2010-12-11 01:40 by Wladimir Palant
I received a payment over $2,500 from Google today. Now the conspiracy theorists among you can go off and rant in all forums that Adblock Plus is sponsored by Google and can no longer be trusted. For those of you who are still with me: the money came though Google’s Vulnerability Reward Program. Recently Google extended the scope of the program to web applications. I took up the challenge and sure enough, in a few hours I found four vulnerabilities in various corners of google.com.
The wrong way to deal with privacy concerns · 2010-05-26 14:30 by Wladimir Palant
Generally, I am not the guy to pick on Google. I think that they usually bring out very solid (often brilliant) solutions and do a good job on the privacy front (meaning: far from perfect but significantly better than the competition). All the more surprising was their release of the Google Analytics Opt-out Browser Add-on which doesn’t quite live up to the expected quality.
One way to get outdated plugins on your computer · 2010-01-28 15:45 by Wladimir Palant
Only two days ago I wrote how browser plugins are the biggest security risk today. And yesterday I experienced first-hand how one would get outdated and insecure plugins installed. I installed Lexware Steuer 2009 (for the German readers: yes, that’s the one you get at Aldi and that always gets good marks in software tests). And then Secunia PSI went berserk warning me about various security threats on my computer. Turned out, this application installed without even telling me: Java Runtime Environment 1.6.0 Update 2 (released July 2007, current version is 1.6.0 Update 18), Flash Player ActiveX 9.0.124.0 (released April 2008, current version is 10.0.42.34), MSXML 4.0 SP2 (released June 2003, current version is 4.0 SP3).
The new browser security landscape · 2010-01-26 12:22 by Wladimir Palant
Brian Krebs came across one of those websites throwing a battery of exploits at users and took a close look at its administration page. It lists seven exploits, the two most successful ones being for Adobe Reader and Java, followed by two Internet Explorer exploits. At the far end of the list two Firefox exploits can be found as well. From what I understand, only one Adobe Reader vulnerability was unpatched at that time, all other vulnerabilities have been fixed already. For example, the Java exploit targets a security hole that was closed in December 2008, the exploited Firefox vulnerabilities have been closed in Firefox 1.0.5 and 1.5.0.5 respectively.
Mercurial over HTTPS - ouch, SSL isn't always secure · 2009-11-18 08:43 by Wladimir Palant
I set up my Mercurial server as HTTPS only. The idea behind it was that establishing a secure communication channel outweighs the disadvantages (server load, more traffic and somewhat slower pull operations) for a small server like that. But then I had second thoughts — I am using a StartCom certificate that isn’t yet accepted everywhere, what if somebody cannot pull the repository because of that?