1
Bitwarden design flaw: Server side iterations
Bitwarden is a hot candidate for a LastPass replacement. Looking into how they encrypt data, it doesn’t do things that much better however.
Wladimir Palant
Wladimir Palant's blog
- Popular posts
- 14
- Total points
- 4,347
- HN comments
- 2,052
- Rank
- #283 personal
Visit palant.info → On Hacker News Sep 2020 – Oct 2024
Security & Privacy 14Web & Frontend 9Society, Policy & Culture 3Networking & Internet 1Tech Industry & Business 1
2
How did LastPass master passwords get compromised?
LastPass accounts are under attack. I look into how user’s master passwords might have leaked.
3
More malicious extensions in Chrome Web Store
So far I discovered 18 malicious extensions with 55 million users in total. Most popular ones are: Autoskip for Youtube, Crystal Ad block and Brisk VPN. They have been active for two years, undetected by Google.
4
Anti-fingerprinting extensions tend to make fingerprinting easier
Browser extensions claiming to protect against fingerprinting will typically result in more data available for fingerprinting.
5
TouchEn nxKey: A keylogging anti-keylogger solution
TouchEn nxKey is supposed to combat keyloggers. Instead, this application made writing a keylogger extremely simple, allowed attacking banking websites and more.
6
Amazon Assistant lets Amazon track your every move on the web
Amazon Assistant browser extension delegates its wide range of privileges to Amazon web services. The potential for misuse is enormous.
7
The Karma connection in Chrome Web Store
A bunch of malicious extensions in Chrome Web Store have hidden affiliate fraud functionality, collect users’ browsing profiles, or both. These extensions appear to be connected to the Karma shopping assistant, developed by Karma Shopping Ltd. which is not a small company.
8
A grim outlook on the future of browser add-ons
Mozilla limiting users’ choice to 9 add-ons on mobile is only the latest development. Add-on support is degrading across all browsers and will continue to do so.
9
Another cluster of potentially malicious Chrome extensions
I discovered a cluster of at least 109 extensions in Chrome Web Store. A few are committing affiliate fraud or spying, most are simply hoarding overly wide privileges before abusing them.