E
Eli Grey
eligrey.com · Personal blog · on HN since 2009
Eli Grey, a security researcher and developer, writes about browser vulnerabilities, link fraud, and tools such as Zerodrop and Favioli.
What HN saysHN commenters cite his posts as evidence of the Gmail/Inbox spoofing flaw, Google's link-fraud handling, and as a source on browser choice and Zerodrop.
16HN people shared it
8linked it in comments
27stories submitted
430story points
2 years agolast shared
2009people per year2026
Most-shared posts
- 1Google Inbox spoofing vulnerability5 people · 12 points · first shared 2018 · 1 comments on HN
- 2Big Tech's role in enabling link fraud2 people · 236 points · first shared 2024 · 51 comments on HN
- 3Better Font Smoothing in Google Chrome on Windows2 people · 6 points · first shared 2010 · discussion on HN
- 4Zerodrop: Open-source stealth URL toolkit for bypassing censorship filters2 people · 3 points · first shared 2018 · discussion on HN
- 5Homepage2 people · first shared 2018
- 6Show HN: Favioli – Replace blank tab icons with unique per-domain emoji1 people · 94 points · first shared 2018 · 17 comments on HN
- 7Unverified vanity URLs and interest tracking catalyze fraud online1 people · 36 points · first shared 2024 · 24 comments on HN
- 8Publicly-disclosed UXSS flaw was exploited against Opera users for over 2 years1 people · 18 points · first shared 2018 · 4 comments on HN
- 9Choosing a Browser1 people · 4 points · first shared 2025 · 2 comments on HN
- 10Saving generated files on the client-side1 people · 3 points · first shared 2014 · 1 comments on HN
- 11Pmxdr: postMessage XDR JavaScript Library1 people · 2 points · first shared 2009 · discussion on HN
- 12Saving generated files on the client-side1 people · 2 points · first shared 2011 · discussion on HN
- 13Sandboxing JavaScript using web workers1 people · 2 points · first shared 2009 · discussion on HN
- 14XDomainRequest is no longer IE-only1 people · 2 points · first shared 2009 · discussion on HN
- 15Encrypted Duck Duck Go with encrypted Google Suggest1 people · 2 points · first shared 2010 · discussion on HN
What HN people wrote when they linked it
jqpabc123 · 2025-03-12
Chromium is not a good alternative: 95% of Chromium commits come from Google.
Or ... Chromium is the perfect alternative ... as long as it remains open source and privacy invasion can be easily stripped out of it. Let Google fund most of the development of a privacy respecting browser (i.e. Brave).
And if it doesn't remain open source? Then it's time for a fork --- just like it is now with Firefox.
Bottom line: If you reject Chromium, shouldn't you also reject Mozilla/Firefox? Virtually all development over the past decade was funded by Google.
https://eligrey.com/
Sephr · 2025-03-05
If only Ladybird development had taken off sooner. The best balance of {respectful defaults, security, privacy, extensibility} out of the top 5 browsers seems to be Brave[1] for now, which isn't the most ideal situation.
1. https://eligrey.com/blog/choosing-a-browser/
bcye · 2025-01-20
It's explained in replies to the tweet, Google apparently lets you specify a "display URL", that's updated immediately but only verified within 24h for trusted accounts. (https://eligrey.com/blog/link-fraud/)
invalidusernam3 · 2019-01-22
Funny considering Google still has a UX vulnerability in their gmail interface: https://eligrey.com/blog/google-inbox-spoofing-vulnerability/
"The link mailto:”[email protected]”<[email protected]> shows up as “[email protected]” in the Google Inbox composition window, visually identical to any email actually sent to PayPal."
It has been fixed in the web version, but apparently the Android app still has this issue
eboyjr · 2018-06-08
There is also https://github.com/oftn-oswg/zerodrop which supports expiry and blacklists with geofencing.
Info: https://eligrey.com/blog/zerodrop/
mathias · 2012-02-20
You can in fact apply CSS to non-HTML documents through the `Link` header. Here’s an example: http://eligrey.com/blog/post/title-image-files-in-opera
Similarly, full `Link` header support would also make it possible to have feed-autodiscovery on non-HTML pages (like images, audio, video, plain text files, etc).
juriga · 2012-01-28
Chrome on Windows doesn't use the DirectWrite text rendering engine as opposed to Firefox or IE. See details here:
http://eligrey.com/blog/post/better-font-smoothing-in-google-chrome-on…
This has been an open issue since 2009. I'm surprised it still hasn't been fixed even though it's a daily nuisance in the world of beautiful web fonts and large type sizes:
http://code.google.com/p/chromium/issues/detail?id=25541
http://code.google.com/p/chromium/issues/detail?id=105944
EDIT: an official DirectWrite port of Chrome/Win is currently under development:
https://groups.google.com/a/chromium.org/group/chromium-dev/browse_thr…
pbhjpbhj · 2012-04-12
The first time you saw substitution ciphers you thought "hey how about using webfonts as a one time key"?
I guess because I learnt about such ciphers when our primary school only just got it's first computer, running at 4MHz, the conflation of webfonts and subst. ciphers never struck me before.
Before today I've seen this done with javascript and, TBH, I think that would have been the first method that sprung to mind but I've not really ever bothered to think about it.
Quick search only found one other example of this technique: http://eligrey.com/blog/post/tag/rot13 (rot13 fonts, lol) as well as this http://jsfiddle.net/QQ9WQ/ from the current author. It's hard to search as there is a font called "cipher font", which of course is available as a webfont! Of course there are lots of pages using js, like http://rumkin.com/tools/cipher/substitution.php which does some funky substitutions.