You know, I really dislike ad blockers from the security perspective. They need exceptionally broad permissions that make the extension a juicy target for attacks. Pop one of the maintainers' Google or Github accounts and own hundreds of millions of people overnight - their email, bank accounts, social media identities, and all that.
The consequences of simple coding errors are similarly disastrous - and I bet that there are some good UXSS bugs lurking in all that JavaScript.
For these reasons, I resisted ad blockers for 20+ years, and I endured countless cookie prompts, subscription interstitials, "sponsored results", and unskippable ads. But around 2020, the anti-user patterns on the web have gotten unbearable. And I say this as a person who grew up in the era of auto-playing Flash-based pop-under ads.
I'm not a security absolutist. It's all about trade-offs: the convenience of using a modern web browser, for example, generally outweighs the risks of living with its massive attack surface. But in the case of ad blockers, you gotta take a hit just to continue to browse in peace. It blows.
@lcamtuf my "adblocker" is a combination of NoScript and a few dozen diverts to 127.x.x.x IPs in /etc/hosts
It doesn't free me from the increasingly obnoxious youtube ads, but other than that it cleans things up quite well, I just keep wondering why pages have big gaps in their content.😉
I am well aware, this is all dependent on preferences and browsing habits. "YMMV" @isotopp
@lcamtuf I've been running with JavaScript off on my primary browser for years now, then just white listing domains when I have to. Quite a lot of effort, but as you say the web experience is awful by default. =|
@lcamtuf
One can minimise the risk by using a multi-browser strategy.
One browser. Preferably #Firefox, set to not accept cookies at all. #Whitelist as you go. Use for email, banking and #ecommerce
One browser. Maybe #edge or #safari. Use for general browsing. Install as many extensions as you like to remove ads, cookie permission notices, etc.
Clear #cookies when it becomes slow.
@lcamtuf@tqbf ive always felt exactly the same. finally had to start using an ad blocker a couple years ago. it was either that or get off the web and i want to be on the web.
@lcamtuf This. A thousand times this. I actually want to support sites by viewing their ads (or paying them) but the auto playing videos, css screen takeover pop ups, tracking cookies, JavaScript bogged sites make it so difficult. Just have a simple banner ad and I won’t block it I swear.
One solution is to use different browsers: one for trusted websites (e.g., for banking), another for shopping online, and yet another for everything else. The latter one has an ad blocker.
@lcamtuf well risk of well maintained ad blockers like unlock origin is very, very small comparing to windows updates which have been known to bring outdated tools with newest update installation. I guess ad blockers go into the category of risk assessment how paranoid you are
@lcamtuf i installed a pihole, and while there are definitely some risks that come with letting an ad blocking device own your DNS, I still feel a lot better about that than about some random dude owning my JavaScript.
No exaggeration, the web is now unusable to me from outside my own network because I can’t tolerate the ada… but the internet when I’m at home is so nice.
@lcamtuf
Isn't the bigger attack vector the regularly updating lists those adblockers are using?
Was thinking about switching away from ublock again and again but I don't think the alternatives are as convenient. Especially for family members not tech-savvy
@lcamtuf Instead of an ad-blocker, I turn of JS and allowlist JS for sites I use regularly that need it (eg, github). Most of those sites don't have ads, or have very curated ads.
Most news/blog/etc sites are readable but slightly broken with JS off. A few have a covering element or opacity 0 that gets removed by JS, and if I visit those sites often, I fix that with a custom CSS rule (with Stylus).
Occasionally, I'll copy a URL to a non-persistent Chrome profile with JS enabled
@lcamtuf Very well said and if I had business cards I'd consider putting "I'm not a security absolutist" on them.
However, when I click something and get deluged with tons of distracting ads I hit the back button and figure that I can live without knowing whatever clickbait (it's never really anything important or valuable).
What I do doesn't matter to the web, of course, but if more people simply avoided these miserable websites it could be a powerful signal.
@lcamtuf Speaking of ad blockers in general. I dislike the concept of lists:. 1) they are always incomplete and 2) regular updates cause privacy issues. My approach to this problem: Disable 3p-frames, 3p-scripts and additionally all 3p-content at all. I am surfing the web basically with everything not coming from the original domain blocked. It works! If any browser would offer this, I would drop uBlock. Interestingly, no browser does.
@lcamtuf Safari (both iOS and Mac) has a different model for content blockers that prevents them from any access to your browsing — they declare rules and then Safari enforces them. Much better security model.
Add comment