The Curious Engineer

All blogs / Security

text/plain

textslashplain.com

ericlaw talks about security, the web, and software in general

SecurityFrontend / CSS / browsers

’15’20’25
Posts
433 from 28 Sep 2012 to 24 Sep 2026
Posting
weekly (25 in the last year)
Kind
personal blog
Feed
https://textslashplain.com/feed/

2026 23

  1. “The” IP Address
  2. Experimentation: Just Try It!
  3. Simple Browser Security Improvements
  4. The Windows Security App
  5. Attack Technique: AI Clones
  6. Fiddler in 2026
  7. Web Security is Too Hard
  8. Authenticode and UAC
  9. Attack Techniques: Fake Captive Portals
  10. Offboarding from Microsoft Defender for Endpoint
  11. Guidelines for URL Storage and Comparison
  12. Driving (Large) Electric
  13. A Quarter Century in Tech
  14. Participatory Extensible Security
  15. Spring 10Ks
  16. Cybersecurity Metaphors
  17. Exploiting Vulnerable Drivers
  18. Smart App Control
  19. Attack Techniques: RMM Abuse
  20. Understanding Defender AV Scans
  21. Windows: Choose Where To Get Apps
  22. Winter 2026 Runs
  23. Security Software False Positives

2025 25

  1. Security Surfaces
  2. Defensive Technology: Ransomware Data Recovery
  3. Windows Shell Previews – Restricted
  4. An Improbable Recovery
  5. AI Injection Attacks
  6. 2025 Summer Vacation
  7. Security Product Efficacy
  8. Family Safety Content Filtering
  9. First Look: Apple’s NEURLFilter API
  10. Web Category Filtering
  11. Fiddler in 2025
  12. Attack Techniques: Fake Literally Everything! (Escrow Scam)
  13. Vibe-coding for security
  14. Understanding SmartScreen and Network Protection
  15. A Solid 10K
  16. Defensive Technology: Exploit Protection
  17. Defensive Technology: Windows Filtering Platform
  18. Runtime Signature Checking Threat Model
  19. Spring Break
  20. Debugging Chromium
  21. Authenticode in 2025 – Azure Trusted Signing
  22. Guidelines for Secure Filename Display
  23. Attack Techniques: “I Already Hacked You” Scams
  24. Winter 2025 Races
  25. Welcome to 2025!

2024 38

  1. On Mortality
  2. Mark-of-the-Web: Real-World Protection
  3. My New Desktop
  4. Fiddler – My Mistakes
  5. Parallel Downloading
  6. Security Software – An Overview
  7. Best Practices for SmartScreen AppRep
  8. Defensive Technology: Controlled Folder Access
  9. On Politics
  10. Lenovo P1, Gen7: Meh
  11. Defensive Technology: Antimalware Scan Interface (AMSI)
  12. Content-Blocking in Manifest v3
  13. Attack Techniques: Encrypted Archives
  14. Welcome to Fall, I guess?
  15. Browser Features: Find in Page
  16. Memento Mori – Farewells
  17. Attack Techniques: Invoice Scams
  18. Attack Techniques: Trojaned Clipboard
  19. Authenticode in 2024
  20. Attack Techniques: Remote Control Software
  21. Attack Techniques: Full-Trust Script Downloads
  22. Spring 2024 Updates
  23. ERR_BLOCKED_BY_CLIENT and HTML5 Sandbox
  24. Mouse Gestures in Edge
  25. Going Electric – Solar 1 Year Later
  26. Browser Security Bugs that Aren’t: JavaScript in PDF
  27. A Slow 10K
  28. Attacker Techniques: Gesture Jacking
  29. pushState and URL Blocking
  30. Browser Extensions: Powerful and Potentially Dangerous
  31. Second Seaside Half
  32. The Importance of Feedback Loops
  33. Cloaking, Detonation, and Client-side Phishing Detection
  34. x22i Treadmill Review
  35. How Downloads Work
  36. A Cold and Slow 3M Half
  37. The Blind Doorkeeper Problem, or, Why Enclaves are Tricky
  38. Coding at Google

2023 66

  1. Fall 2023 Races
  2. Defense Techniques: Blocking Protocol Handlers
  3. Attack Techniques: Steganography
  4. Troubleshooting Edge (or Chrome) Broken UI
  5. Troubleshooting Edge (or Chrome) Browser Crashes
  6. Driving Electric – One Year In
  7. Protecting Auth Tokens
  8. ServiceWorkers vs. Network Filtering
  9. Security: The Impact of Time
  10. Beware: URLs are Pointers to Mutable Entities
  11. Email Etiquette: Avoid BCC’ing large distribution lists
  12. Fiddler Web Debugger Turns 20
  13. Security Tradeoffs: Privacy
  14. Security: Tradeoffs
  15. Web Platform Weirdness: Babies and Bathwater
  16. Web Weirdness: Probing Localhost
  17. Attack Techniques: Fullscreen Abuse
  18. The Challenge of IP Reputation
  19. Defensive Techniques: Application Guard
  20. Kilimanjaro – To Exit Gate & Home
  21. Kilimanjaro – Descent to Mweka
  22. Kilimanjaro – To Summit
  23. Kilimanjaro – To Kosovo/Respicius Camp
  24. Kilimanjaro – Up Barranco Wall to Karanga Camp
  25. Kilimanjaro – To Lava Tower and Barranco Camp
  26. Kilimanjaro – To Shira 2 Camp
  27. Kilimanjaro – To Shira 1 Camp
  28. Kilimanjaro – Trailhead to Forest Camp
  29. Kilimanjaro – Meet the Team; To Ndarakwai Lodge
  30. Kilimanjaro – Mini Safari
  31. SmartScreen Application Reputation, with Pictures
  32. Divorce – 18 Months In
  33. Kilimanjaro – Coffee Tour
  34. Attack Techniques: QR Codes
  35. Enforcing SmartScreen with Policy
  36. Attack Techniques: SMS Gift Card Scams
  37. Kilimanjaro – Getting There
  38. Kilimanjaro 2023 – Journal
  39. Kilimanjaro – Gear
  40. Kilimanjaro – Overview
  41. Browser SSO / Automatic Signin
  42. Improving the Microsoft Defender Browser Protection Extension
  43. How do Random Credentials Mysteriously Appear?
  44. Detecting When the User is Offline
  45. New TLDs: Not Bad, Actually
  46. A Beautiful 10K
  47. (The Futility of) Keeping Secrets from Yourself
  48. Auth Flows in a Partitioned World
  49. Explainer: File Types
  50. How Microsoft Edge Updates
  51. Attack Techniques: Spoofing via UserInfo
  52. Going Electric – Solar
  53. Improving Native Message Host Reliability on Windows
  54. Attack Techniques: Open Redirectors, CAPTCHAs, Site Proxies, and IPFS, oh my
  55. Slow Seaside Half
  56. Q: “Remember this Device, Doesn’t?!?”
  57. Attack Techniques: Blended Attacks via Telephone
  58. A New Era: PM -> SWE
  59. A Year of Intention
  60. Couch to Half Marathon: Closing My First Year of Running
  61. Defense Techniques: Reporting Phish
  62. SlickRun
  63. 2022 EOY Fitness Summary
  64. Attack Techniques: Priming Attacks on Legitimate Sites
  65. Attack Techniques: Phishing via Mailto
  66. Attack Techniques: Phishing via Local Files

2022 49

  1. ProjectK.commit()
  2. Missed Half
  3. TLS Certificate Verification Changes in Edge
  4. Mark-of-the-Web: Additional Guidance
  5. Q4 2022 Races
  6. Driving Electric
  7. Thoughts on Twitter
  8. “Not Secure” Warning for IE Mode
  9. Microsoft Employee’s Guide to Maximizing Donations
  10. Q: Why do tabs sometimes show an orange dot?
  11. Capturing Logs for Debugging SmartScreen
  12. Cruising Alaska (Alaskan Brews Cruise)
  13. HTTPS Goofs: Forgetting the Bare Domain
  14. Best Practice: Post-Mortems
  15. Attack Techniques: Notification Spam
  16. Edge’s Super-Res Image Enhancement
  17. QuickFix: Trivial Chrome Extensions
  18. Passkeys – Syncable WebAuthN credentials
  19. Understanding Browser Channels
  20. Certificate Revocation in Microsoft Edge
  21. New Recipes for 3rd Party Cookies
  22. My Next Opportunity
  23. Edge URL Schemes
  24. End of Q2 Check-in
  25. Captive Portals
  26. Extending Fiddler’s ImageView
  27. “Batteries-Included” vs “Bloated”
  28. Chromium Startup
  29. Microsoft Edge Tips and Tricks
  30. Losing your cookies
  31. Thoughts on Impact
  32. Unexpectedly HTTPS?
  33. Chromium Internals: PAK Files
  34. Real-World Running
  35. End of Q1 Check-in
  36. Chromium’s DNS Cache
  37. The “Magical” Back Button
  38. Edge/Chrome Policy Registry Entries
  39. Smarter Defaults by Paying Attention
  40. Mid-February Checkin
  41. MHTML in Chromium
  42. Adding Protocol Schemes to Chromium
  43. Debugging Compatibility in Edge
  44. Recognizing Edge Windows
  45. Trim Your Whitespace
  46. Debug Native Messaging
  47. Lock down web browsing using Kiosk Mode
  48. getaddrinfo(2022)
  49. Edge Command Line Arguments

2021 18

  1. Cruising Solo
  2. Microsoft Edge’s Many Processes
  3. Great Bug Reports via “Recreate My Problem” in Microsoft Edge
  4. View-Source
  5. Spooky: Enhancing Dark Mode in Chromium
  6. MoarTLS: Non-Secure Download Blocking
  7. Accessibility (UIA) Troubleshooting
  8. Practical Time Machines
  9. Determining OS Platform Version
  10. Inspecting Certificates in Edge
  11. Leaky Abstractions
  12. Offline NetLog Viewing
  13. Download Blocking by File Type
  14. Per-Site Permissions in Edge
  15. Specifying Per-Site Policy with Chromium’s URL Filter Format
  16. Web Proxy Authentication
  17. window.close() Restrictions
  18. Sandboxing vs. Elevated Browsing (As Administrator)

2020 37

  1. Objectively, the best cat
  2. Simply Making Simple Fixes Simple for Chromium
  3. Client Certificates and Logout
  4. Web “Sessions” in Private Mode
  5. Images Keeping You Awake?
  6. Debugging Browsers – Tools and Techniques
  7. Local Data Encryption in Chromium
  8. Web Debugging: Watching Element Changes
  9. Browser Memory Limits
  10. Web-to-App Communication: The Native Messaging API
  11. Font Smoothing in Edge
  12. Managing Edge via Policy
  13. Seamless Single Sign-On
  14. Beating Private Mode Blockers with an Ephemeral Profile
  15. Revealing Passwords
  16. Web Proxy Auto Discovery (WPAD)
  17. Same Origin Policy & CORS
  18. Avoiding Unexpected Navigation
  19. Browser Basics: User Gestures
  20. A bit of GREASE keeps the web moving
  21. META CHARSET
  22. Client Certificate Authentication
  23. Analyzing Network Traffic Logs (NetLog json)
  24. Debugging Proxy Configuration Scripts in the new Edge
  25. Celebrating Fifteen Years
  26. Enigma Conference 2020 – Browser Privacy Panel
  27. “Can I… in the new Edge?” (Un-FAQ)
  28. Bypassing AppProtocol Prompts
  29. Browser Password Managers: Threat Models
  30. Demystifying Browsers
  31. App-to-Web Communication: Launching Web Apps
  32. Microsoft’s Three Browsers
  33. My New Chromium Build PC
  34. Security Zones in Edge (and Chrome)
  35. Retiring Internet Explorer
  36. Capture Network Logs (NetLog) from Edge and Chrome (and Electron and WebView2)
  37. Disabling TLS/1.0 and TLS/1.1 in the new Edge Browser

2019 25

  1. WebOCs and HTTP/2
  2. The Pitfalls of EventSource over HTTP/1.1
  3. AppOrWeb-to-WebApp Communication: Custom Scheme Handlers
  4. Thoughts on DNS-over-HTTPS
  5. bye: FTP Support Is Going Away
  6. Improving Privacy by Limiting Referrers
  7. Restrictions on File Urls
  8. Same-Site Cookies By Default
  9. Aw, snap! What if Every Tab Crashes?
  10. Web-to-App Communication: DirectInvoke
  11. Livin’ on the Edge: Root Causing Regressions
  12. Web-to-App Communication: App Protocols
  13. Browser Architecture: Web-to-App Communication Overview
  14. Spying on HTTPS
  15. Livin’ on the Edge: Dude Where’s My Fix?!? (Redux)
  16. Livin’ on the Edge: Dude Where’s My Fix?!?
  17. Great Product Support
  18. Updating Browsers Quickly: Flags, Respins, and Components
  19. Challenges with Federated Identity in modern browsers
  20. Surprise: Undead Session Cookies
  21. Edge79+ vs. Edge18 (Edge Legacy) vs. Chrome vs. Internet Explorer
  22. Protect Your Accounts with 2FA
  23. Delete Cookies for a Single Site
  24. Securely Displaying URLs
  25. Demystifying ClickOnce

2018 28

  1. Private Browsing Mode
  2. An Update on the Edge XSS Filter
  3. Streaming Audio in Edge
  4. ShellExecute Doesn’t
  5. Cookie Limits
  6. Cookie Controls, Revisited
  7. Firefox and Fiddler – Easier than Ever
  8. Chrome Sync
  9. Cookies and Concurrency, Redux
  10. ERROR_INSUFFICIENT_BUFFER and Concurrency
  11. Edge Interop Issues
  12. Script-Generated Download Files
  13. CORS and Vary
  14. Be skeptical of client-reported MIME Content-Types
  15. Edge EV UI Requires SmartScreen
  16. Back Home
  17. Stop Spilling the Beans
  18. Building your .APP website with NameCheap and GitHub Pages–A Visual Guide
  19. Fight Phish with Facebook (and Certificate Transparency)
  20. Going Offline with ServiceWorker
  21. Google Chrome–Two(ish) Years In
  22. I Still ❤ The Web
  23. SSLVersionMin Policy returns to Chrome 66
  24. HSTS Preload and Subdomains
  25. NET::ERR_CERT_INVALID error
  26. Understanding the Limitations of HTTPS
  27. FiddlerCore and Brotli compression
  28. Content-Types Matter More Than You Think

2017 22

  1. Taking Off Your NameTag
  2. What If?
  3. Strict-Transport-Security for *.dev, *.app and more
  4. For a Lark
  5. Google Internet Authority G3
  6. Chrome Field Trials
  7. Stealing your own password is not a vulnerability
  8. Speaking at DevReach 2017
  9. Working with “Big Data” in .NET
  10. Fiddler And LINQ
  11. Chrome 59 on Mac and TeletexString Fields
  12. Inspecting Certificates in Chrome
  13. Finding Image Bloat In Binary Files
  14. Get Help with HTTPS problems
  15. Chrome Deprecates Subject CN Matching
  16. The Trouble with Magic
  17. Working on Google Chrome – Year One
  18. Certified Malice
  19. The Line of Death
  20. Client Certificates on Android
  21. HTTPS Only Works If You Use It – Tipster Edition
  22. Security UI in Chrome

2016 35

  1. 2016 Brotli Update
  2. Do Not Lie to Users
  3. Useful Resources when Developing Chrome Extensions
  4. Email Tracking Links are the Worst
  5. Troubleshooting Windows 10 Bluescreens
  6. WordPress.com bug post
  7. File the Bug
  8. Using Fiddler With iOS 10 and Android 7
  9. Test post
  10. Cheating Authenticode, Redux
  11. TLS Fallbacks are Dead
  12. Non-Secure Clicktrackers–The Fastest Path from A+ to F
  13. File Paths in Windows
  14. Stupid HexEdit Tricks
  15. Bolstering HTTPS Security
  16. SHA256 and Authenticode REDUX^2
  17. Silliness – Fiddler Blocks Malware
  18. Compression Context
  19. Downloads and the Mark-of-the-Web
  20. Building the moarTLS Analyzer
  21. Seek and Destroy Non-Secure References Using the moarTLS Analyzer
  22. Using HTTPS Properly
  23. On Daylight Savings Time
  24. Out-of-Memory is (Usually) a Lie
  25. Things I’ve Learned in my first weeks on Chrome
  26. Web Developers and Footguns
  27. Leaking Keystrokes
  28. Extended Validation Certificates – The Introduction
  29. Life in Austin
  30. Authenticode and SHA1–Redux
  31. Automatically Evaluating Compressibility
  32. Putting Users First
  33. SHA-1 Certificates Blocked By Authenticode
  34. Authenticode in 2016
  35. Getting Started with Profile Guided Optimization

2015 65

  1. What’s New in Fiddler 4.6.2
  2. 2015 in review
  3. My Next Adventure
  4. Segue
  5. Certificates Matter
  6. Security Response Basics
  7. DLL Hijacking Just Won’t Die
  8. Book-Writing: Just Do It!
  9. Repairing Corrupt ZIP Files
  10. Hashes and Code-Signing
  11. Understanding CONNECT Tunnels
  12. The Sad State of HAR
  13. Reset Fiddler’s HTTPS certificates
  14. DotNet Makes Me Sad, In Pictures
  15. The Budget
  16. What’s New in Fiddler 4.6.0.7
  17. Viewing HTTPS Handshakes in Fiddler
  18. Fiddler and Brotli
  19. Duct Tape and Baling Wire–Cookie Prefixes
  20. WebP–What Isn’t Google Telling Us?
  21. Eloquence
  22. Help–The Whole Web Thinks I’m Using IE7!!!
  23. Ad Publishers–A TODO List
  24. Ad-Block: Current Status
  25. Developer Advocacy
  26. Brotli
  27. Fiddler Certificate Generators
  28. What’s New in Fiddler 4.6
  29. API Testing with Telerik Fiddler
  30. Attribution Error
  31. Tuning MemoryStream
  32. On Defaults
  33. Stupid (useful) Windows Shell Tricks
  34. An A+ HTTPS site for $20
  35. Organizational Awareness
  36. Microsoft Edge Bugs and Omissions
  37. Zopfli All The Things
  38. What I Use–Software Edition
  39. Google Search Provider in Microsoft Edge
  40. Ad Blocking – Site Reaction Gallery
  41. What I Read–Book Edition
  42. HTTPS Only Works If You Use It
  43. Testing HTTPS In Native APPs
  44. Photoshop and Save For Web
  45. Content Blocking: Unintended Consequences
  46. On Chromebooks
  47. Stock Holdings, Mid-2015
  48. Anecdotal Ephemera
  49. The Edge Team
  50. Optimize PNGs using PngDistill
  51. Meaningless Legalese
  52. Reactions to Collateral Damage
  53. Collateral Damage
  54. Medical Bills
  55. The Muse
  56. Unsecure Content
  57. HTTP Caching Public Service Announcement
  58. Browser Benchmarks
  59. Velocity Conference – 2015 Santa Clara
  60. Security UI
  61. OpenSearch
  62. Utf 8
  63. On Appreciation
  64. Authenticode and ClickOnce
  65. Howdy, y’all!

2013 1

  1. How Hard Could It Be

2012 1

  1. OnBeforeUnload