palant.info 30. 10. 2024The Karma connection in Chrome Web Store – palant.info 1. 10. 2024Lies, damned lies, and Impact Hero (refoorest, allcolibri) – palant.info 15. 7. 2024How insecure is Avast Secure Browser? – palant.info 6. 3. 2024Numerous vulnerabilities in Xunlei Accelerator application – palant.info 19. 10. 2023Implementing a “Share on Mastodon” button for a blog – palant.info 5. 9. 2023A year after the disastrous breach, LastPass has not improved – palant.info 29. 8. 2023Chrome Sync privacy is still very bad – palant.info 14. 6. 2023Why browser extension games need access to all websites – palant.info 8. 6. 2023Another cluster of potentially malicious Chrome extensions – palant.info 5. 6. 2023Introducing PCVARK and their malicious ad blockers – palant.info 2. 6. 2023How malicious extensions hide running arbitrary code – palant.info 31. 5. 2023More malicious extensions in Chrome Web Store – palant.info 16. 5. 2023Malicious code in PDF Toolbox extension – palant.info 10. 5. 2023Online Security extension: Destroying privacy for no good reason – palant.info 2. 5. 2023A way forward for PfP: Pain-free Passwords – palant.info 17. 4. 2023Processing a complex syntax with Rust’s declarative macros – palant.info 29. 3. 2023Documenting KeePass KDBX4 file format – palant.info 20. 3. 2023The end of PfP: Pain-free Passwords – palant.info 8. 3. 2023Converting incoming emails on the fly with OpenSMTPD filters – palant.info 6. 3. 2023Veraport: Inside Korea’s dysfunctional application management – palant.info 28. 2. 2023LastPass breach update: The few additional bits of information – palant.info 20. 2. 2023South Korea’s banking security: Intermediate conclusions – palant.info 13. 2. 2023Automating Windows installation in a VM – palant.info 6. 2. 2023Weakening TLS protection, South Korean style – palant.info 30. 1. 2023Password strength explained – palant.info 25. 1. 2023IPinside: Korea’s mandatory spyware – palant.info 23. 1. 2023Bitwarden design flaw: Server side iterations – palant.info 9. 1. 2023TouchEn nxKey: The keylogging anti-keylogger solution – palant.info 2. 1. 2023South Korea’s online security dead end – palant.info 28. 12. 2022LastPass breach: The significance of these password iterations – palant.info 26. 12. 2022What’s in a PR statement: LastPass breach explained – palant.info 24. 12. 2022What data does LastPass encrypt? – palant.info 23. 12. 2022LastPass has been breached: What now? – palant.info 8. 12. 2022Common pitfalls of breaking up HTTPS connections – palant.info 6. 10. 2022Scirge: When your employer mandates spyware – palant.info 31. 8. 2022When extension pages are web-accessible – palant.info 24. 8. 2022Attack surface of extension pages – palant.info 17. 8. 2022Impact of extension privileges – palant.info 10. 8. 2022Anatomy of a basic extension – palant.info 23. 5. 2022Hijacking webcams with Screencastify – palant.info 19. 4. 2022Adobe Acrobat hollowing out same-origin policy – palant.info 14. 3. 2022Party time: Injecting code into Teleparty extension – palant.info 1. 3. 2022Skype extension: All functionality broken? Still exploitable! – palant.info 8. 2. 2022Writing my own build system: Coupling gulp concepts with modern JavaScript – palant.info 29. 12. 2021How did LastPass master passwords get compromised? – palant.info 20. 12. 2021Yes, fun browser extensions can have vulnerabilities too! – palant.info 5. 10. 2021Abusing Keepa Price Tracker to track users on Amazon pages – palant.info 28. 9. 2021Breaking Custom Cursor to p0wn the web – palant.info 2. 8. 2021Data exfiltration in Keepa Price Tracker – palant.info 28. 6. 2021Having fun with CSS injection in a browser extension – palant.info 4. 5. 2021Universal XSS in Ninja Cookie extension – palant.info 13. 4. 2021Print Friendly & PDF: Full compromise – palant.info 22. 3. 2021Follow-up on Amazon Assistant’s data collection – palant.info 15. 3. 2021DuckDuckGo Privacy Essentials vulnerabilities: Insecure communication and Universal XSS – palant.info 8. 3. 2021How Amazon Assistant lets Amazon track your every move on the web – palant.info 22. 2. 2021Setup for testing Android app vulnerabilities – palant.info 18. 2. 2021Reverse engineering a Unity-based Android game – palant.info 10. 12. 2020How anti-fingerprinting extensions tend to make fingerprinting easier – palant.info 9. 11. 2020Adding DKIM support to OpenSMTPD with custom filters – palant.info 28. 10. 2020What would you risk for free Honey? – palant.info 3. 9. 2020Added Webmention support to the blog – palant.info 31. 8. 2020A grim outlook on the future of browser add-ons – palant.info 6. 7. 2020Dismantling BullGuard Antivirus’ online protection – palant.info 22. 6. 2020Exploiting Bitdefender Antivirus: RCE from any website – palant.info 16. 6. 2020Does Signal's "secure value recovery" really work? – palant.info
30. 10. 2024The Karma connection in Chrome Web Store – palant.info 1. 10. 2024Lies, damned lies, and Impact Hero (refoorest, allcolibri) – palant.info 15. 7. 2024How insecure is Avast Secure Browser? – palant.info 6. 3. 2024Numerous vulnerabilities in Xunlei Accelerator application – palant.info 19. 10. 2023Implementing a “Share on Mastodon” button for a blog – palant.info 5. 9. 2023A year after the disastrous breach, LastPass has not improved – palant.info 29. 8. 2023Chrome Sync privacy is still very bad – palant.info 14. 6. 2023Why browser extension games need access to all websites – palant.info 8. 6. 2023Another cluster of potentially malicious Chrome extensions – palant.info 5. 6. 2023Introducing PCVARK and their malicious ad blockers – palant.info 2. 6. 2023How malicious extensions hide running arbitrary code – palant.info 31. 5. 2023More malicious extensions in Chrome Web Store – palant.info 16. 5. 2023Malicious code in PDF Toolbox extension – palant.info 10. 5. 2023Online Security extension: Destroying privacy for no good reason – palant.info 2. 5. 2023A way forward for PfP: Pain-free Passwords – palant.info 17. 4. 2023Processing a complex syntax with Rust’s declarative macros – palant.info 29. 3. 2023Documenting KeePass KDBX4 file format – palant.info 20. 3. 2023The end of PfP: Pain-free Passwords – palant.info 8. 3. 2023Converting incoming emails on the fly with OpenSMTPD filters – palant.info 6. 3. 2023Veraport: Inside Korea’s dysfunctional application management – palant.info 28. 2. 2023LastPass breach update: The few additional bits of information – palant.info 20. 2. 2023South Korea’s banking security: Intermediate conclusions – palant.info 13. 2. 2023Automating Windows installation in a VM – palant.info 6. 2. 2023Weakening TLS protection, South Korean style – palant.info 30. 1. 2023Password strength explained – palant.info 25. 1. 2023IPinside: Korea’s mandatory spyware – palant.info 23. 1. 2023Bitwarden design flaw: Server side iterations – palant.info 9. 1. 2023TouchEn nxKey: The keylogging anti-keylogger solution – palant.info 2. 1. 2023South Korea’s online security dead end – palant.info 28. 12. 2022LastPass breach: The significance of these password iterations – palant.info 26. 12. 2022What’s in a PR statement: LastPass breach explained – palant.info 24. 12. 2022What data does LastPass encrypt? – palant.info 23. 12. 2022LastPass has been breached: What now? – palant.info 8. 12. 2022Common pitfalls of breaking up HTTPS connections – palant.info 6. 10. 2022Scirge: When your employer mandates spyware – palant.info 31. 8. 2022When extension pages are web-accessible – palant.info 24. 8. 2022Attack surface of extension pages – palant.info 17. 8. 2022Impact of extension privileges – palant.info 10. 8. 2022Anatomy of a basic extension – palant.info 23. 5. 2022Hijacking webcams with Screencastify – palant.info 19. 4. 2022Adobe Acrobat hollowing out same-origin policy – palant.info 14. 3. 2022Party time: Injecting code into Teleparty extension – palant.info 1. 3. 2022Skype extension: All functionality broken? Still exploitable! – palant.info 8. 2. 2022Writing my own build system: Coupling gulp concepts with modern JavaScript – palant.info 29. 12. 2021How did LastPass master passwords get compromised? – palant.info 20. 12. 2021Yes, fun browser extensions can have vulnerabilities too! – palant.info 5. 10. 2021Abusing Keepa Price Tracker to track users on Amazon pages – palant.info 28. 9. 2021Breaking Custom Cursor to p0wn the web – palant.info 2. 8. 2021Data exfiltration in Keepa Price Tracker – palant.info 28. 6. 2021Having fun with CSS injection in a browser extension – palant.info 4. 5. 2021Universal XSS in Ninja Cookie extension – palant.info 13. 4. 2021Print Friendly & PDF: Full compromise – palant.info 22. 3. 2021Follow-up on Amazon Assistant’s data collection – palant.info 15. 3. 2021DuckDuckGo Privacy Essentials vulnerabilities: Insecure communication and Universal XSS – palant.info 8. 3. 2021How Amazon Assistant lets Amazon track your every move on the web – palant.info 22. 2. 2021Setup for testing Android app vulnerabilities – palant.info 18. 2. 2021Reverse engineering a Unity-based Android game – palant.info 10. 12. 2020How anti-fingerprinting extensions tend to make fingerprinting easier – palant.info 9. 11. 2020Adding DKIM support to OpenSMTPD with custom filters – palant.info 28. 10. 2020What would you risk for free Honey? – palant.info 3. 9. 2020Added Webmention support to the blog – palant.info 31. 8. 2020A grim outlook on the future of browser add-ons – palant.info 6. 7. 2020Dismantling BullGuard Antivirus’ online protection – palant.info 22. 6. 2020Exploiting Bitdefender Antivirus: RCE from any website – palant.info 16. 6. 2020Does Signal's "secure value recovery" really work? – palant.info