The Curious Engineer

All blogs / Security

Almost Secure

palant.info

Wladimir Palant's blog

SecurityReverse engineering

’10’15’20’25
Posts
243 from 6 Aug 2006 to 3 Feb 2026
Posting
now and then (5 in the last year)
Kind
personal blog
Feed
https://palant.info/rss.xml

2026 3

  1. Supporting Wayland’s XDG activation protocol with Gtk/Glib
  2. Backdoors in VStarcam cameras
  3. Analysis of PPPP “encryption”

2025 8

  1. Unpacking VStarcam firmware for fun and profit
  2. An overview of the PPPP protocol for IoT cameras
  3. A look at a P2P camera (LookCam app)
  4. Analysis of an advanced malicious Chrome extension
  5. Malicious extensions circumvent Google’s remote code ban
  6. Chrome Web Store is a mess
  7. BIScience: Collecting browsing history under false pretenses
  8. How extensions trick CWS search

2024 4

  1. The Karma connection in Chrome Web Store
  2. Lies, damned lies, and Colibri Hero (refoorest, allcolibri)
  3. How insecure is Avast Secure Browser?
  4. Numerous vulnerabilities in Xunlei Accelerator application

2023 25

  1. Implementing a “Share on Mastodon” button for a blog
  2. A year after the disastrous breach, LastPass has not improved
  3. Chrome Sync privacy is still very bad
  4. Why browser extension games need access to all websites
  5. Another cluster of potentially malicious Chrome extensions
  6. Introducing PCVARK and their malicious ad blockers
  7. How malicious extensions hide running arbitrary code
  8. More malicious extensions in Chrome Web Store
  9. Malicious code in PDF Toolbox extension
  10. Online Security extension: Destroying privacy for no good reason
  11. A way forward for PfP: Pain-free Passwords
  12. Processing a complex syntax with Rust’s declarative macros
  13. Documenting KeePass KDBX4 file format
  14. The end of PfP: Pain-free Passwords
  15. Converting incoming emails on the fly with OpenSMTPD filters
  16. Veraport: Inside Korea’s dysfunctional application management
  17. LastPass breach update: The few additional bits of information
  18. South Korea’s banking security: Intermediate conclusions
  19. Automating Windows installation in a VM
  20. Weakening TLS protection, South Korean style
  21. Password strength explained
  22. IPinside: Korea’s mandatory spyware
  23. Bitwarden design flaw: Server side iterations
  24. TouchEn nxKey: The keylogging anti-keylogger solution
  25. South Korea’s online security dead end

2022 15

  1. LastPass breach: The significance of these password iterations
  2. What’s in a PR statement: LastPass breach explained
  3. What data does LastPass encrypt?
  4. LastPass has been breached: What now?
  5. Common pitfalls of breaking up HTTPS connections
  6. Scirge: When your employer mandates spyware
  7. When extension pages are web-accessible
  8. Attack surface of extension pages
  9. Impact of extension privileges
  10. Anatomy of a basic extension
  11. Hijacking webcams with Screencastify
  12. Adobe Acrobat hollowing out same-origin policy
  13. Party time: Injecting code into Teleparty extension
  14. Skype extension: All functionality broken? Still exploitable!
  15. Writing my own build system: Coupling gulp concepts with modern JavaScript

2021 13

  1. How did LastPass master passwords get compromised?
  2. Yes, fun browser extensions can have vulnerabilities too!
  3. Abusing Keepa Price Tracker to track users on Amazon pages
  4. Breaking Custom Cursor to p0wn the web
  5. Data exfiltration in Keepa Price Tracker
  6. Having fun with CSS injection in a browser extension
  7. Universal XSS in Ninja Cookie extension
  8. Print Friendly & PDF: Full compromise
  9. Follow-up on Amazon Assistant’s data collection
  10. DuckDuckGo Privacy Essentials vulnerabilities: Insecure communication and Universal XSS
  11. How Amazon Assistant lets Amazon track your every move on the web
  12. Setup for testing Android app vulnerabilities
  13. Reverse engineering a Unity-based Android game

2020 18

  1. How anti-fingerprinting extensions tend to make fingerprinting easier
  2. Adding DKIM support to OpenSMTPD with custom filters
  3. What would you risk for free Honey?
  4. Added Webmention support to the blog
  5. A grim outlook on the future of browser add-ons
  6. Dismantling BullGuard Antivirus’ online protection
  7. Exploiting Bitdefender Antivirus: RCE from any website
  8. Does Signal’s “secure value recovery” really work?
  9. The easier way to use lunr search with Hugo
  10. What data does Xiaomi collect about you?
  11. Are Xiaomi browsers spyware? Yes, they are…
  12. Yahoo! and AOL: Where two-factor authentication makes your account less secure
  13. PSA: jQuery is bad for the security of your project
  14. McAfee WebAdvisor: From XSS in a sandboxed browser extension to administrator privileges
  15. Insights from Avast/Jumpshot data: Pitfalls of data anonymization
  16. Avast’s broken data anonymization approach
  17. Pwning Avast Secure Browser for fun and profit
  18. Avast complies to respect users’ privacy

2019 18

  1. Problematic monetization in security products, Avira edition
  2. Mozilla and Opera remove Avast extensions from their add-on stores, what will Google do?
  3. Rendering McAfee web protection ineffective
  4. More Kaspersky vulnerabilities: uninstalling extensions, user tracking, predictable links
  5. Assorted Kaspersky vulnerabilities
  6. Internal Kaspersky API exposed to websites
  7. Kaspersky: The art of keeping your keys under the door mat
  8. Avast Online Security and Avast Secure Browser are spying on you
  9. PfP: Pain-free Passwords security review
  10. State of the art protection in Chrome Web Store
  11. Kaspersky in the Middle – what could possibly go wrong?
  12. Recognizing basic security flaws in local password managers
  13. Various RememBear security issues
  14. Bogus security mechanisms: Encrypting localhost traffic
  15. Switching my blog to a static site generator
  16. Dear Mozilla, please stop spamming!
  17. Should you be concerned about LastPass uploading your passwords to its server?
  18. How much privacy do you have left on the web?

2018 24

  1. BBN challenge resolution: Getting the flag from a browser extension
  2. If your bug bounty program is private, why do you have it?
  3. BBN challenge resolution: Exploiting the Screenshotter.PRO browser extension
  4. Maximizing password manager attack surface: Learning from Kaspersky
  5. BBN challenge resolutions: “A properly secured parameter” and “Exploiting a static page”
  6. As far as I’m concerned, email signing/encryption is dead
  7. Should your next web-based login form avoid sending passwords in clear text?
  8. So Google is now claiming: “no one (including Google) can access your data”
  9. Keybase: “Our browser extension subverts our encryption, but why should we care?”
  10. Password managers: Please make sure AutoFill is secure!
  11. Präsentation über Digitalisierung und soziale Interaktion
  12. FTAPI SecuTransfer – the secure alternative to emails? Not quite…
  13. Is your LastPass data really safe in the encrypted online vault?
  14. Google to developers: We take down your extension, because we can
  15. Ryzom falling: Remote code execution via the in-game browser
  16. The ticking time bomb: Fake ad blockers in Chrome Web Store
  17. The Firefox Accounts authentication zoo
  18. Can Chrome Sync or Firefox Sync be trusted with sensitive data?
  19. Master password in Firefox or Thunderbird? Do not bother!
  20. Implementing safe sync functionality in a server-less extension
  21. Links for my SINFO 25 presentation
  22. Easy Passwords is now PfP: Pain-free Passwords
  23. News flash: encrypted.google.com is not special in any way
  24. Getting published Docker container ports to work with IPv6

2017 8

  1. Taking a break from Adblock Plus development
  2. On Web Extensions shortcomings and their impact on add-on security
  3. Observations on managed bug bounty programs
  4. Revisiting permission prompt for Firefox extensions
  5. Easy Passwords released as a Web Extension
  6. How bad is a buffer overflow in an Emscripten-compiled application?
  7. Is undetectable ad blocking possible?
  8. LastPass: Security done wrong

2016 12

  1. Implementing efficient PBKDF2 for the browser
  2. Validating news stories: Syrian oil
  3. More Last Pass security vulnerabilities
  4. Easy Passwords moving forward – filling in user names
  5. Safari extension format (.safariextz) explained
  6. Why Mozilla shouldn’t copy Chrome’s permission prompt for extensions
  7. Underestimated issue: Hashing passwords without salts
  8. Adventures porting Easy Passwords to Chrome and back to Firefox
  9. Security considerations for password generators
  10. Introducing Easy Passwords: the new best way to juggle all those passwords
  11. Why you should go with “secure by default” for your web application
  12. Compiling C++ to JavaScript: Emscripten vs. Cheerp

2015 7

  1. Mozilla: What constitutes “open source”?
  2. Using WebExtensions APIs in a “classic” extension
  3. Why you probably want to disable jQuery.parseHTML even though you don’t call it
  4. Missing a rationale for WebExtensions
  5. JavaScript Deobfuscator reloaded
  6. Don’t forget to check the facts – because nobody else will
  7. Mozilla’s rollout of Yahoo! as default search engine (a.k.a. What’s up with Firefox 34.0.5?)

2014 14

  1. Can Mozilla be trusted with privacy?
  2. A systematic approach to MDN documentation?
  3. Dumbing down HTML content for AMO
  4. “Unloading” frame scripts in restartless extensions
  5. Using a Firefox extension to work around Selenium WebDriver’s limitations
  6. Which is better, Adblock or Adblock Plus?
  7. Please don’t use externally hosted JavaScript libraries
  8. Third-party JavaScript – more critical than ever
  9. Proxies breaking up SSL connections? Yes, all the time…
  10. Enforcing HTTPS connections on websites
  11. Extension security and add-on stores
  12. Crazy hacks: Changing Wine key mappings on Mac OS X
  13. Solution to a problem nobody has: Changing Total Commander application icon
  14. New blog

2012 6

  1. Modularization in a restartless extension
  2. Why you should make your next add-on restartless
  3. Closed my LinkedIn account
  4. Preventing background tabs from wasting your computer’s resources
  5. Random thoughts on democracy and Russian presidential election
  6. Faster extension development cycle: install changes automatically

2011 5

  1. Random thought on communities
  2. Google Chrome and pre-installed web apps
  3. EU MozCamp, theme development, add-on localization with adofex
  4. Binary XPCOM components are dead – js-ctypes is the way to go
  5. Running Linux in the browser

2010 8

  1. Finding security issues in a website (or: How to get paid by Google)
  2. XULRunner in large projects, part 4: Localization pitfalls
  3. XULRunner in large projects, part 3: Bugs, bugs, and more bugs
  4. XULRunner in large projects, part 2: Why XULRunner isn’t like Java
  5. XULRunner in large projects, part 1: What is that “XULRunner” thingy, anyway?
  6. Ah, that wonderful Flash installation experience…
  7. One way to get outdated plugins on your computer
  8. The new browser security landscape

2009 15

  1. AMO getting serious about add-on security
  2. Atomic orbital viewer with WebGL
  3. New job again
  4. Downloading Xenocode’s “sandboxed” applications
  5. Selecting countries on a map in Firefox 3.5
  6. Hidden cost of (not) using Venkman
  7. Getting rid of Flash cookies
  8. Avoiding naming conflicts in overlays
  9. More extension puzzles
  10. Analyzing huge piles of code
  11. Five wrong reasons to use eval() in an extension
  12. Vulnerable extensions survey
  13. Displaying web content in an extension – without security issues
  14. Deobfuscating JavaScript
  15. On the new Ctrl+Tab behavior

2008 11

  1. Different ways to force garbage collection
  2. Fake “hg rebase” implementation
  3. Making modal dialogs work on Mac OS X
  4. Reconfiguring CheckPoint VPN-1 to allow FTPS connections
  5. Emulating Window.openDialog with JavaScript arguments in an XPCOM component
  6. Worst service ever
  7. HTTP Referer header won’t help you with CSRF
  8. Web pages accessing chrome:// is forbidden
  9. What software update isn’t
  10. TomTom HOME and add-ons
  11. Vulnerability or feature?

2007 21

  1. What is going on with Internet Explorer?
  2. Predictable whitelists strike again
  3. Status update
  4. Get WebRunner 0.5 while it is hot!
  5. Getting application name and icon right with XULRunner
  6. Mozilla Developer Day: XUL vs. HTML
  7. New job
  8. Moving again
  9. The hazards of MIME sniffing
  10. Yet another round of extension recommendations
  11. Legal implications of security research
  12. Java and Firefox memory usage
  13. Usability vs. Security
  14. Encouraging innovation
  15. Blacklists, whitelists, and security
  16. Why “Save Page As HTML, complete” sucks
  17. Getting back to Oslo
  18. Running a web server is dangerous
  19. Speaking of IE security…
  20. AMO moving into the right direction
  21. Firefox security: the real picture

2006 8

  1. Looking for a job again
  2. Spell checker rants
  3. No good deed goes unpunished
  4. What happened to the promised spam solution?
  5. Moving to Germany
  6. It is traveling time again
  7. Google does it again
  8. “Don’t mail us unless you are in the US”