Wladimir Palant

Should you be concerned about LastPass uploading your passwords to its server?

The answer to this question is still "Yes!" Here I demonstrate yet another way for the server to access your data, the issues being structural.

Which is better, Adblock or Adblock Plus?

Note: This is explicitly posted in my private blog rather than the Adblock Plus blog. This post represents my own opinion only. It is likely unwise to rant about a competing project but I just don’t want to keep my findings to myself. If you are here for Adblock Plus bashing and don’t care enough to read the post…

Mozilla and Opera remove Avast extensions from their add-on stores

The Avast extensions which were spying on their users are no longer available from Mozilla and Opera add-on stores. Google still has to take action.

LastPass: Security done wrong

Disclaimer: I am the author of Easy Passwords which is also a password manager and could be considered LastPass competitor in the widest sense. Six month ago I wrote a detailed analysis of LastPass security architecture. In particular, I wrote:

Keybase’s browser extension subverts its encryption

The Keybase browser extension subverts the app's end-to-end encryption. Keybase considers that "an acceptable risk" and not worth fixing.

Maximizing password manager attack surface

Kaspersky Password Manager uses a unique approach to maximize the attack surface. A quick introduction.

Dear Mozilla, please stop spamming

Detailing Mozilla's failures to send newsletters only to users who actually opted in.

Fake ad blockers in Chrome Web Store

People searching for a Google Chrome ad blocking extension have to choose from dozens of similarly named extensions. Only few of these are legitimate, most are forks of open source ad blockers trying to attract users with misleading extension names and descriptions. What are these up to? Thanks to Andrey Meshkov we…

Taking a break from Adblock Plus development

After twelve years of working on Adblock Plus, the time seems right for me to take a break. The project’s dependence on me has been on the decline for quite a while already. Six years ago we founded eyeo, a company that would put the former hobby project on a more solid foundation. Two years ago Felix Dahlke took over…

Master password in Firefox or Thunderbird? Do not bother

There is a weakness common to any software letting you protect a piece of data with a password: how does that password translate into an encryption key? If that conversion is a fast one, then you better don’t expect the encryption to hold. Somebody who gets hold of that encrypted data will try to guess the password…

Mozilla shouldn't copy Chrome's permission prompt for extensions

As Mozilla’s Web Extensions project is getting closer towards being usable, quite a few people seem to expect some variant of Chrome’s permission prompt to be implemented in Firefox. So instead of just asking you whether you want to trust an add-on Firefox should list exactly what kind of permissions an add-on needs…

Kaspersky in the Middle – what could possibly go wrong?

On Web Extensions shortcomings and their impact on add-on security

Recently, I reported a security issue in the new Firefox Screenshots feature (fixed in Firefox 56). This issue is remarkable for a number of reasons. First of all, the vulnerable code was running within the Web Extensions sandbox, meaning that it didn’t have full privileges like regular Firefox code. This code was…