Articles

2023

• Introducing PCVARK and their malicious ad blockers June 5
• How malicious extensions hide running arbitrary code June 2
• More malicious extensions in Chrome Web Store May 31
• Malicious code in PDF Toolbox extension May 16
• Online Security extension: Destroying privacy for no good reason May 10
• A way forward for PfP: Pain-free Passwords May 2
• Processing a complex syntax with Rust’s declarative macros April 17
• Documenting KeePass KDBX4 file format March 29
• The end of PfP: Pain-free Passwords March 20
• Converting incoming emails on the fly with OpenSMTPD filters March 8
• Veraport: Inside Korea’s dysfunctional application management March 6
• LastPass breach update: The few additional bits of information February 28
• South Korea’s banking security: Intermediate conclusions February 20
• Automating Windows installation in a VM February 13
• Weakening TLS protection, South Korean style February 6
• Password strength explained January 30
• IPinside: Korea’s mandatory spyware January 25
• Bitwarden design flaw: Server side iterations January 23
• TouchEn nxKey: The keylogging anti-keylogger solution January 9
• South Korea’s online security dead end January 2

2022

• LastPass breach: The significance of these password iterations December 28
• What’s in a PR statement: LastPass breach explained December 26
• What data does LastPass encrypt? December 24
• LastPass has been breached: What now? December 23
• Common pitfalls of breaking up HTTPS connections December 8
• Scirge: When your employer mandates spyware October 6
• When extension pages are web-accessible August 31
• Attack surface of extension pages August 24
• Impact of extension privileges August 17
• Anatomy of a basic extension August 10
• Hijacking webcams with Screencastify May 23
• Adobe Acrobat hollowing out same-origin policy April 19
• Party time: Injecting code into Teleparty extension March 14
• Skype extension: All functionality broken? Still exploitable! March 1
• Writing my own build system: Coupling gulp concepts with modern JavaScript February 8

2021

• How did LastPass master passwords get compromised? December 29
• Yes, fun browser extensions can have vulnerabilities too! December 20
• Abusing Keepa Price Tracker to track users on Amazon pages October 5
• Breaking Custom Cursor to p0wn the web September 28
• Data exfiltration in Keepa Price Tracker August 2
• Having fun with CSS injection in a browser extension June 28
• Universal XSS in Ninja Cookie extension May 4
• Print Friendly & PDF: Full compromise April 13
• Follow-up on Amazon Assistant’s data collection March 22
• DuckDuckGo Privacy Essentials vulnerabilities: Insecure communication and Universal XSS March 15
• How Amazon Assistant lets Amazon track your every move on the web March 8
• Setup for testing Android app vulnerabilities February 22
• Reverse engineering a Unity-based Android game February 18

2020

• How anti-fingerprinting extensions tend to make fingerprinting easier December 10
• Adding DKIM support to OpenSMTPD with custom filters November 9
• What would you risk for free Honey? October 28
• Added Webmention support to the blog September 3
• A grim outlook on the future of browser add-ons August 31
• Dismantling BullGuard Antivirus’ online protection July 6
• Exploiting Bitdefender Antivirus: RCE from any website June 22
• Does Signal’s “secure value recovery” really work? June 16
• The easier way to use lunr search with Hugo June 4
• What data does Xiaomi collect about you? May 8
• Are Xiaomi browsers spyware? Yes, they are… May 4
• Yahoo! and AOL: Where two-factor authentication makes your account less secure March 9
• PSA: jQuery is bad for the security of your project March 2
• McAfee WebAdvisor: From XSS in a sandboxed browser extension to administrator privileges February 25
• Insights from Avast/Jumpshot data: Pitfalls of data anonymization February 18
• Avast’s broken data anonymization approach January 27
• Pwning Avast Secure Browser for fun and profit January 13
• Avast complies to respect users’ privacy January 8

2019

• Problematic monetization in security products, Avira edition December 11
• Mozilla and Opera remove Avast extensions from their add-on stores, what will Google do? December 3
• Rendering McAfee web protection ineffective December 2
• More Kaspersky vulnerabilities: uninstalling extensions, user tracking, predictable links November 27
• Assorted Kaspersky vulnerabilities November 27
• Internal Kaspersky API exposed to websites November 26
• Kaspersky: The art of keeping your keys under the door mat November 25
• Avast Online Security and Avast Secure Browser are spying on you October 28
• PfP: Pain-free Passwords security review September 26
• State of the art protection in Chrome Web Store September 9
• Kaspersky in the Middle – what could possibly go wrong? August 19
• Recognizing basic security flaws in local password managers August 12
• Various RememBear security issues July 8
• Bogus security mechanisms: Encrypting localhost traffic April 11
• Switching my blog to a static site generator April 4
• Dear Mozilla, please stop spamming! April 3
• Should you be concerned about LastPass uploading your passwords to its server? March 18
• How much privacy do you have left on the web? March 12

2018

• BBN challenge resolution: Getting the flag from a browser extension December 17
• If your bug bounty program is private, why do you have it? December 10
• BBN challenge resolution: Exploiting the Screenshotter.PRO browser extension December 10
• Maximizing password manager attack surface: Learning from Kaspersky November 30
• BBN challenge resolutions: “A properly secured parameter” and “Exploiting a static page” November 28
• As far as I’m concerned, email signing/encryption is dead November 12
• Should your next web-based login form avoid sending passwords in clear text? October 25
• So Google is now claiming: “no one (including Google) can access your data” October 15
• Keybase: “Our browser extension subverts our encryption, but why should we care?” September 6
• Password managers: Please make sure AutoFill is secure! August 29
• Präsentation über Digitalisierung und soziale Interaktion August 16
• FTAPI SecuTransfer – the secure alternative to emails? Not quite… July 11
• Is your LastPass data really safe in the encrypted online vault? July 9
• Google to developers: We take down your extension, because we can July 3
• Ryzom falling: Remote code execution via the in-game browser May 18
• The ticking time bomb: Fake ad blockers in Chrome Web Store April 18
• The Firefox Accounts authentication zoo March 27
• Can Chrome Sync or Firefox Sync be trusted with sensitive data? March 13
• Master password in Firefox or Thunderbird? Do not bother! March 10
• Implementing safe sync functionality in a server-less extension March 8
• Links for my SINFO 25 presentation March 2
• Easy Passwords is now PfP: Pain-free Passwords February 7
• News flash: encrypted.google.com is not special in any way January 13
• Getting published Docker container ports to work with IPv6 January 5

2017

• Taking a break from Adblock Plus development December 20
• On Web Extensions shortcomings and their impact on add-on security November 11
• Observations on managed bug bounty programs October 4
• Revisiting permission prompt for Firefox extensions August 5
• Easy Passwords released as a Web Extension July 17
• How bad is a buffer overflow in an Emscripten-compiled application? April 23
• Is undetectable ad blocking possible? April 19
• LastPass: Security done wrong March 23

2016

• Implementing efficient PBKDF2 for the browser October 25
• Validating news stories: Syrian oil October 23
• More Last Pass security vulnerabilities September 16
• Easy Passwords moving forward – filling in user names September 5
• Safari extension format (.safariextz) explained August 17
• Why Mozilla shouldn’t copy Chrome’s permission prompt for extensions July 2
• Underestimated issue: Hashing passwords without salts May 4
• Adventures porting Easy Passwords to Chrome and back to Firefox May 2
• Security considerations for password generators April 20
• Introducing Easy Passwords: the new best way to juggle all those passwords April 19
• Why you should go with “secure by default” for your web application March 2
• Compiling C++ to JavaScript: Emscripten vs. Cheerp February 5

2015

• Mozilla: What constitutes “open source”? October 24
• Using WebExtensions APIs in a “classic” extension October 15
• Why you probably want to disable jQuery.parseHTML even though you don’t call it August 30
• Missing a rationale for WebExtensions August 23
• JavaScript Deobfuscator reloaded July 17
• Don’t forget to check the facts – because nobody else will May 31
• Mozilla’s rollout of Yahoo! as default search engine (a.k.a. What’s up with Firefox 34.0.5?) January 12

2014

• Can Mozilla be trusted with privacy? December 19
• A systematic approach to MDN documentation? December 4
• Dumbing down HTML content for AMO December 3
• “Unloading” frame scripts in restartless extensions November 19
• Using a Firefox extension to work around Selenium WebDriver’s limitations August 29
• Which is better, Adblock or Adblock Plus? July 29
• Please don’t use externally hosted JavaScript libraries June 30
• Third-party JavaScript – more critical than ever June 27
• Proxies breaking up SSL connections? Yes, all the time… May 27
• Enforcing HTTPS connections on websites March 30
• Extension security and add-on stores February 25
• Crazy hacks: Changing Wine key mappings on Mac OS X February 14
• Solution to a problem nobody has: Changing Total Commander application icon February 13
• New blog February 13

2012

• Modularization in a restartless extension July 12
• Why you should make your next add-on restartless July 12
• Closed my LinkedIn account June 8
• Preventing background tabs from wasting your computer’s resources May 12
• Random thoughts on democracy and Russian presidential election March 12
• Faster extension development cycle: install changes automatically January 13

2011

• Random thought on communities December 15
• Google Chrome and pre-installed web apps November 15
• EU MozCamp, theme development, add-on localization with adofex November 13
• Binary XPCOM components are dead – js-ctypes is the way to go July 12
• Running Linux in the browser May 17

2010

• Finding security issues in a website (or: How to get paid by Google) December 11
• XULRunner in large projects, part 4: Localization pitfalls July 17
• XULRunner in large projects, part 3: Bugs, bugs, and more bugs July 5
• XULRunner in large projects, part 2: Why XULRunner isn’t like Java July 4
• XULRunner in large projects, part 1: What is that “XULRunner” thingy, anyway? July 2
• Ah, that wonderful Flash installation experience… April 22
• One way to get outdated plugins on your computer January 28
• The new browser security landscape January 26

2009

• AMO getting serious about add-on security November 14
• Atomic orbital viewer with WebGL October 4
• New job again September 2
• Downloading Xenocode’s “sandboxed” applications August 28
• Selecting countries on a map in Firefox 3.5 June 20
• Hidden cost of (not) using Venkman March 12
• Getting rid of Flash cookies March 2
• Avoiding naming conflicts in overlays February 16
• More extension puzzles February 11
• Analyzing huge piles of code February 10
• Five wrong reasons to use eval() in an extension February 6
• Vulnerable extensions survey February 5
• Displaying web content in an extension – without security issues January 28
• Deobfuscating JavaScript January 12
• On the new Ctrl+Tab behavior January 9

2008

• Different ways to force garbage collection November 20
• Fake “hg rebase” implementation October 24
• Making modal dialogs work on Mac OS X September 15
• Reconfiguring CheckPoint VPN-1 to allow FTPS connections July 13
• Emulating Window.openDialog with JavaScript arguments in an XPCOM component July 2
• Worst service ever June 8
• HTTP Referer header won’t help you with CSRF May 21
• Web pages accessing chrome:// is forbidden April 13
• What software update isn’t March 23
• TomTom HOME and add-ons March 17
• Vulnerability or feature? February 6

2007

• What is going on with Internet Explorer? December 6
• Predictable whitelists strike again November 5
• Status update August 26
• Get WebRunner 0.5 while it is hot! July 11
• Getting application name and icon right with XULRunner June 29
• Mozilla Developer Day: XUL vs. HTML June 25
• New job June 15
• Moving again May 16
• The hazards of MIME sniffing April 29
• Yet another round of extension recommendations April 16
• Legal implications of security research April 8
• Java and Firefox memory usage April 4
• Usability vs. Security March 24
• Encouraging innovation March 16
• Blacklists, whitelists, and security March 15
• Why “Save Page As HTML, complete” sucks March 14
• Getting back to Oslo March 1
• Running a web server is dangerous January 17
• Speaking of IE security… January 12
• AMO moving into the right direction January 12
• Firefox security: the real picture January 5

2006

• Looking for a job again December 20
• Spell checker rants December 11
• No good deed goes unpunished December 3
• What happened to the promised spam solution? November 23
• Moving to Germany November 11
• It is traveling time again October 3
• Google does it again September 21
• “Don’t mail us unless you are in the US” August 6