Wladimir Palant

Unfortunately, this kind of thinking leads to insane situations such as the South Korean banking cartel which requires users to install several pieces of "security software"[1] which make your computer more vulnerable to security issues[2] and almost certainly doesn't protect anyone from actual fraud -- classic security theatre. There needs to be a point where enough is enough, and locking down devices so that you cannot install programs nor practically use custom operating systems on them anymore is way past that line. [1]: https://palant.info/2023/01/02/south-koreas-online-security-dead-end/ [2]: https://ee.kaist.ac.kr/en/research-achieve/in-south-korea-mandatory-fi…

I said this in a reply comment, but it's likely Honey lost it due to mass reporting or _maybe_ (but unlikely) a manual decision, and now that time has passed, they've applied again (the badge "nomination" is just a form you fill in) after a short while and either the manual reviewer was unaware, or it just doesn't matter to the process, as the requirement are quite low. It's possible larger extensions (1+ mil) have some sway/means to contact internally, but imo Google really doesn't pay much heed to "controversial"/topical things (perhaps apart from ublock). Or developers in general. It becomes evident when you read some extensive related articles by Wladimir Palant (https://palant.info) [0] who does some pretty deep dives on the Chrome Store. I think he even developed Adblock Plus (the open-source version). [0] I'm unaffiliated, just a reader.

Nope. See the following page for some screenshots of the UI to turn on encryption with sync passphrases: https://palant.info/2023/08/29/chrome-sync-privacy-is-still-very-bad/

Worst advice. Imagine the risks you are putting yourself into when trusting all these 3rd-party browser extensions https://palant.info/2022/08/10/anatomy-of-a-basic-extension/ It's better to use something like piped that has the following features: https://github.com/TeamPiped/Piped#features

Don't bother. It's hard to do it correctly. If you look through the snippets (or the MDN docs[1]), the value is retrieved using the getParameter() function. You might be tempted to override the function by doing something like gl.getParameter = () => "test" but that's easily detectable. If you run gl.getParameter.toString() You get back "() => "test"" whereas the original function you get back "function getParameter() { [native code] }" In general, don't try to fix fingerprinting via content scripts[2]. It's very much detectable. Your best bet is a browser that handles it natively. [1] https://developer.mozilla.org/en-US/docs/Web/API/WEBGL_debug_renderer_… [2] https://palant.info/2020/12/10/how-anti-fingerprinting-extensions-tend…

Ubiquity did the same thing with their routers. They couldn’t understand why users had such a problem with their phone home feature that was on by default when the purpose of it was to ultimately “improve” the user experience. I didn’t buy their router as a result. I also removed kaspersky from my computer because I didn’t like their phone home feature. Turns out they were selling my data despite holding my trust as a security company. DDG, don’t turn this into a PR nightmare. We don’t trust anyone anymore. Privacy policies are worthless. Nobody cares about favicons anyway. Source: https://www.theregister.com/2019/11/07/ubiquiti_networks_phone_home/ https://palant.info/2019/08/19/kaspersky-in-the-middle-what-could-poss…

Some of you here might be thinking, "well you can always use a passphrase while using chrome sync" to mitigate all privacy issues. I generally advocate use of a passphrase to people I know. BUT digging a bit into it I found that chrome's encryption is NOT STRONG AT ALL. Here[1] the author describes that brute force is possible within 4 days if the sync passphrase has 40 bits of entropy, with $1000 hardware. So with more expensive hardware, this can be done within minutes. TBF even firefox is not excellent in this regard(based on the article), but it is much better. [1]:https://palant.de/2018/03/13/can-chrome-sync-or-firefox-sync-be-truste… and associate chrome bug : https://bugs.chromium.org/p/chromium/issues/detail?id=820976

Might I suggest reading the following articles: https://palant.de/2016/09/16/more-last-pass-security-vulnerabilities https://palant.de/2017/03/23/lastpass-security-done-wrong

You assume that regulation can just make security magically happen. I see no reason to assume that premise to be correct in practice. It's not like the US Government hasn't been breached countless times or had Supreme Court opinions leaked; and it's not like corporations that really tried and should be examples of best practice haven't also been breached. Also, what law can prevent insider attacks? There's already plenty of laws making that illegal. There's no law that just "makes security happen" - and, actually, I would be fundamentally opposed to such a law because it turns security into a simple matter of compliance. "We're SCA compliant, therefore we're good!" And technology changes way too much - a security law that was written 10 years ago would be a disaster today. See South Korea's Banking Security laws for an example - they basically enshrined ActiveX in their law with roll-your-own-crypto to this day. And we know now that was a trash idea but nobody wants to take the blame for upsetting the security standards. https://palant.info/2023/01/02/south-koreas-online-security-dead-end/

Thing is: this is the third article on the topic I wrote in the past few days. Covering your options wasn’t the goal here, it’s in the first article: https://palant.info/2022/12/23/lastpass-has-been-breached-what-now/. Particularly the “executive summary” at the start. As to the “speculations”: I have sufficient experience with LastPass press releases to assume the worst whenever they omit details that they should definitely know. On a number of occasions they covered security vulnerabilities that I found, and I know how they operate. Mind you, I would be more than happy to learn that I’m wrong. But this isn’t a situation where “hope for the best” is a viable approach. Note: I did not claim that LastPass is storing master passwords. They claim that they built their system in a way that they cannot. And I merely point out that this isn’t true: they could have built their system in such a way, but they chose not to, despite being warned about it repeatedly.

And I am a fan of making such functionality part of the browser :P : one less addon to manage & trust! Aside: the amount of insecure code in addons is scary, see https://palant.info/categories/security/ , not to mention that addons are also a frequent cause of performance trouble (source: me, experienced several times). Thus, the more dubious addon code I'm able to replace with somewhat-well-maintained-and-audited Firefox code with many eyeballs on it, the better. (At this point, you or a passerby will point at the Pocket fiasco and argue that there's too much stuff shoved into our browsers and just stahp it already. Fair, and I love lean software too. I'd still like this specific feature because A. it's not Pocket, B. it aligns well with what Firefox is doing these days, and C. it aligns with what I expect from my user agent of choice). Then, supposing this ever makes its way into Fx, you can choose not to use it. And by the way, maybe like you, I will make the same choice if the Fx feature is too basic! But it will remain a win, for the users for whom it's good enough and who would never have bothered with an addon in the first place. Just like ETP vs. uBlock / PrivacyBadger / etc: ETP is a good basic "80%/20%" risk-less step in the right direction, and addons remains way ahead if you the user decide to bother a bit more. > "telling Firefox to disable [HTTPS only] mode for a specific site doesn't always work." This looks like a bug that you should report.

There's a ton of (known and reported, though google has made that difficult now) malicious extensions on the chrome web store, see e. g. https://palant.info/2025/01/13/chrome-web-store-is-a-mess/

Google spent all that time pushing Manifest V3 but does little to prevent this, and in some cases even encourages it. [1] > To provide a more tangible example, Chrome Web Store currently has Blaze VPN, Safum VPN and Snap VPN extensions carry the “Featured” badge. These extensions (along with Ishaan VPN which has barely any users) belong to the PDF Toolbox cluster which produced malicious extensions in the past. A cursory code inspection reveals that all four are identical and in fact clones of Nucleus VPN which was removed from Chrome Web Store in 2021. And they also don’t even work, no connections succeed. The extension not working is something users of Nucleus VPN complained about already, a fact that the extension compensated with fake reviews. [1] https://palant.info/2025/01/13/chrome-web-store-is-a-mess/

This other research points to this type of pattern (sending all URLs to a server to allegedly provide functionality) being used under false pretenses: https://palant.info/2025/01/13/biscience-collecting-browsing-history-u… In particular, look for the diagram provided by a data vendor showing this in action. As with safebrowsing and adblocking extensions, there is no need to send data to servers. Many groups of smart people have developed client-side and/or privacy-preserving implementations that have worked with high effectiveness for decades. Unfortunately, many other groups have also financial incentives to not care about user privacy, so they go the route shown in the research.

I agree with your point. And meanwhile in Korea (according to article I've read) to use any bank's website you have to install a spy software in your PC. It looks like every major service vendor is organising a crawling subversion against their users and they really count we won't notice. One of the articles: https://palant.info/2023/01/02/south-koreas-online-security-dead-end/

You should worry, system users are relied on to effectively separate privileges even in "single-user" desktops. This has led to privilege escalation before, not to mention the potential for browsers to access these ports [0]. That said, a random password should be enough protection, even if it isn't the cleanest solution. [0]: e.g. https://palant.info/2020/06/22/exploiting-bitdefender-antivirus-rce-fr…

You can request your Chrome history from Google Takeout; I don't see how this is possible if they don't have access to your browser history. Edit: it looks like e2ee is an option, though it's not the default, and Google goes out of their way to make this inconvenient for users: https://palant.info/2023/08/29/chrome-sync-privacy-is-still-very-bad/ But unless you're able to ensure that all users of your cryptpad documents have e2ee configured with a strong password, it's likely that Google will see the URLs with decryption keys to your cryptpad docs. It only takes one weak link...

LastPass does not use the secret key concept that 1Password uses, it only uses a key derived from your password. After the breach they rushed to increase the hash iterations [1] and added features to let enterprise admins set minimum iterations [2] but of course it was too late at that point. [1] https://palant.info/2022/12/28/lastpass-breach-the-significance-of-the… [2] https://support.lastpass.com/s/document-item?language=en_US&bundle…

It's funny how a legitimate ad blocker suffers from zealous enforcement while malicious extensions are generally fine. For instance: https://palant.info/2025/01/13/chrome-web-store-is-a-mess/

They stopped emailing me eventually when I started responding with silly replies, these are some of the emails I got about Control Panel for Twitter (~220,000 users on Chrome): https://github.com/insin/control-panel-for-twitter/issues/386 Some of them work in the open, I've had emails from the people behind this scam: https://palant.info/2024/10/01/lies-damned-lies-and-impact-hero-refoor…

Concerns about Honey were raised four years ago by Wladimir Palant: https://palant.info/2020/10/28/what-would-you-risk-for-free-honey/

And even if it isn't screwed up by active malice... don't be surprised if it's screwed up by pure incompetence. South Korea's internet is still plagued by government-approved encryption standards, which, due to the deprecation of ActiveX, sometimes require installing institution-specific cryptography software to tunnel connections through a local HTTP server so it can be encrypted outside of the web browser - https://palant.info/2023/01/02/south-koreas-online-security-dead-end/

South Korea has some requirement like this for banking if I recall correctly https://palant.info/2023/02/06/weakening-tls-protection-south-korean-s…

I did a google search to respond to your comment because I was pretty sure that the threat was not a mere hypothetical. https://www.kaspersky.com/blog/dangerous-chrome-extensions-87-million/… https://palant.info/2023/05/16/malicious-code-in-pdf-toolbox-extension… https://palant.info/2023/05/31/more-malicious-extensions-in-chrome-web…

2019: LastPass leaks credentials from previous site. https://bugs.chromium.org/p/project-zero/issues/detail?id=1930 2017: Design flaws in LastPass two factor authentication. http://www.martinvigo.com/design-flaws-lastpass-2fa-implementation/ 2016: More LastPass security vulnerabilities. https://palant.de/2016/09/16/more-last-pass-security-vulnerabilities 2015: Even the LastPass will be stolen. http://www.martinvigo.com/even-the-lastpass-will-be-stolen-deal-with-i…

On [1], also note that Firefox's sync is end-to-end encrypted by default. Contrast that to https://palant.info/2023/08/29/chrome-sync-privacy-is-still-very-bad/.

See "Chrome Sync privacy is still very bad"[1] and its predecessor article[2] about Chrome and Firefox for an evaluation of the privacy and security of browser syncing. [1] https://palant.info/2023/08/29/chrome-sync-privacy-is-still-very-bad/ [2] https://palant.info/2018/03/13/can-chrome-sync-or-firefox-sync-be-trus…

You won't probably get what you wish for: this is how it works in South Korea but the solution that the banks went is worse than SMS-OTP, where your bank is expected to monitor your computer (https://palant.info/2023/01/02/south-koreas-online-security-dead-end/)…

Depending on your interests there are a lot of blogs out there. Beautiful Public Data (https://www.beautifulpublicdata.com/) is one of my best finds. Others I read via RSS include: Wladimir Palant's blog 'Almost Secure' https://palant.info/articles/ Ctrl.blog https://www.ctrl.blog/ Troy Hunt's blog https://www.troyhunt.com/ Molly White's newsletter https://newsletter.mollywhite.net

Digging around there appears to be a newer article (which probably prompted the original thread) is here https://palant.info/2023/08/29/chrome-sync-privacy-is-still-very-bad/ which has it's own HN thread here