Top all-time · #812
Wladimir Palant
Personal blog · palant.info · on HN as palantsecurityprogramming
Wladimir Palant writes Almost Secure, a personal blog at palant.info about security and programming. Since 2020, 81 different Hacker News readers have linked it 136 times, most often “South Korea’s online security dead end”. It is still writing: the last post was on 2026-02-03, and you can follow it by feed.
Rarely recommended · 0 of 40 sampled comments recommend it?
Why HN links it
HN readers link palant.info for security analysis of browser extensions, password managers and browser sync, and for documenting malicious Chrome extensions and privacy-hostile software.
Summarised by Claude from a sample of 40 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Wladimir Palant's blog
Most-linked posts?
- South Korea’s online security dead end9 people · 10 mentions · first linked 2023-01-02
- Chrome Sync privacy is still bad7 people · 9 mentions · first linked 2023-08-29
- Bitwarden Design Flaw4 people · 5 mentions · first linked 2023-01-23
- Chrome Web Store is a mess4 people · 4 mentions · first linked 2025-01-13
- Exploiting Bitdefender Antivirus: RCE from any website4 people · 4 mentions · first linked 2020-06-22
- Anti-fingerprinting extensions tend to make fingerprinting easier3 people · 5 mentions · first linked 2020-12-10
- Impact of Extension Privileges3 people · 3 mentions · first linked 2022-08-17
- Password Strength Explained3 people · 3 mentions · first linked 2023-01-31
- How did LastPass master passwords get compromised?3 people · 3 mentions · first linked 2021-12-30
- Pcvark and their malicious ad blockers3 people · 3 mentions · first linked 2023-06-05
What Hacker News says?
Unfortunately, this kind of thinking leads to insane situations such as the South Korean banking cartel which requires users to install several pieces of "security software"[1] which make your computer more vulnerable to security issues[2] and almost certainly doesn't protect anyone from actual fraud -- classic security theatre. There needs to be a point where enough is enough, and locking down devices so that you c…
Comment linking /2023/01/02/south-koreas-online-security-dead-end/
on “Google will allow only apps from verified developers to be installed on Android”Submitted Are Xiaomi browsers spyware? Yes, they are (2020) as a story · 1215 points
HN discussionI agree with your point. And meanwhile in Korea (according to article I've read) to use any bank's website you have to install a spy software in your PC. It looks like every major service vendor is organising a crawling subversion against their users and they really count we won't notice. One of the articles: https://palant.info/2023/01/02/south-koreas-online-security-...
Comment linking /2023/01/02/south-koreas-online-security-dead-end/
on “We should have the ability to run any code we want on hardware we own”Submitted How did LastPass master passwords get compromised? as a story · 309 points
HN discussionOn [1], also note that Firefox's sync is end-to-end encrypted by default. Contrast that to https://palant.info/2023/08/29/chrome-sync-privacy-is-still-... .
Comment linking /2023/08/29/chrome-sync-privacy-is-still-very-bad/
on “In 2024, please switch to Firefox”Submitted Anti-fingerprinting extensions tend to make fingerprinting easier as a story · 206 points
HN discussionYes, I’ve already seen this. I’ve written https://palant.info/2021/12/29/how-did-lastpass-master-passw... discussing the possibilities here. So far the most likely suspicion is that LastPass infrastructure is compromised and a pass-the-hash attack is going on.
Comment linking /2021/12/29/how-did-lastpass-master-passwords-get-compromised/
on “Ask HN: How did my LastPass master password get leaked?”Submitted Amazon Assistant lets Amazon track your every move on the web as a story · 178 points
HN discussionIt’s unlikely to be due to a browser extension. A browser extension that can steal your master password can steal all the other passwords as well, it doesn’t need LastPass for that. More importantly, an extension can only steal your master password when it is used – yet several people reported not having used LastPass for a year or more. It’s still not impossible that an extension has been stealing master passwords…
Comment linking /2018/07/09/is-your-lastpass-data-really-safe-in-the-encrypted-online-vault/
on “Ask HN: How did my LastPass master password get leaked?”Submitted The Karma connection in Chrome Web Store as a story · 154 points
HN discussionUbiquity did the same thing with their routers. They couldn’t understand why users had such a problem with their phone home feature that was on by default when the purpose of it was to ultimately “improve” the user experience. I didn’t buy their router as a result. I also removed kaspersky from my computer because I didn’t like their phone home feature. Turns out they were selling my data despite holding my trust as…
Comment linking /2019/08/19/kaspersky-in-the-middle-what-could-possibly-go-wrong/
on “DuckDuckGo browser seemingly sends domains a user visits to DDG servers”Submitted A grim outlook on the future of browser add-ons as a story · 112 points
HN discussionAnd I am a fan of making such functionality part of the browser :P : one less addon to manage & trust! Aside: the amount of insecure code in addons is scary, see https://palant.info/categories/security/ , not to mention that addons are also a frequent cause of performance trouble (source: me, experienced several times). Thus, the more dubious addon code I'm able to replace with somewhat-well-maintained-and-audited F…
Comment linking /categories/security/
on “ClearURLs – automatically remove tracking elements from URLs”Submitted Lies, damned lies, and Impact Hero (refoorest, allcolibri) as a story · 76 points
HN discussionBasically, they planned to get around much of the problem by depending on a very insecure secure enclave to make up for a lack of basic sound security practices. The scheme they came up with to store user data in the cloud was described here: https://signal.org/blog/secure-value-recovery/ The code is here: https://github.com/signalapp/SecureValueRecovery This site does a pretty good job of explaining why this isn't…
Comment linking /2020/06/16/does-signals-secure-value-recovery-really-work/
on “Twilio incident: What Signal users need to know”Submitted Data exfiltration in Keepa Price Tracker as a story · 62 points
HN discussionI know. I really wish they had a simple page that explains everything. They've gone to great lengths to be confusing about what they're collecting and how. There were several complaints about misleading communication when this change rolled out Examples: https://community.signalusers.org/t/dont-want-pin-dont-want-... https://old.reddit.com/r/signal/comments/htmzrr/psa_disablin... They've never updated their privacy…
Comment linking /2020/06/16/does-signals-secure-value-recovery-really-work/
on “Twilio incident: What Signal users need to know”Submitted Pitfalls of Data Anonymization as a story · 45 points
HN discussionSomewhat relevant: https://palant.info/2023/08/29/chrome-sync-privacy-is-still-...
Comment linking /2023/08/29/chrome-sync-privacy-is-still-very-bad/
on “Firefox Sync actually works”Submitted Malicious extensions circumvent Google's remote code ban as a story · 30 points
HN discussionSee "Chrome Sync privacy is still very bad"[1] and its predecessor article[2] about Chrome and Firefox for an evaluation of the privacy and security of browser syncing. [1] https://palant.info/2023/08/29/chrome-sync-privacy-is-still-... [2] https://palant.info/2018/03/13/can-chrome-sync-or-firefox-sy...
Comment linking /2018/03/13/can-chrome-sync-or-firefox-sync-be-trusted-with-sensitive-data/
on “Firefox Sync actually works”Submitted A grim outlook on the future of browser add-ons as a story · 27 points
HN discussionDon't bother. It's hard to do it correctly. If you look through the snippets (or the MDN docs[1]), the value is retrieved using the getParameter() function. You might be tempted to override the function by doing something like gl.getParameter = () => "test" but that's easily detectable. If you run gl.getParameter.toString() You get back "() => "test"" whereas the original function you get back "function getParameter…
Comment linking /2020/12/10/how-anti-fingerprinting-extensions-tend-to-make-fingerprinting-easier/
on “Are top websites using WebGL for fingerprinting?”Submitted Impact of Extension Privileges as a story · 17 points
HN discussion> I have found this extension helpful for helping mitigate WebGL fingerprinting on Firefox — https://addons.mozilla.org/en-US/firefox/addon/webgl-fingerp ... It might work for simple fingerprinting scripts, but not for anti-anti-fingerprinting scripts. See: https://palant.info/2020/12/10/how-anti-fingerprinting-exten... . Since you're already on firefox, you're probably better off enabling resistfingerprinting inste…
Comment linking /2020/12/10/how-anti-fingerprinting-extensions-tend-to-make-fingerprinting-easier/
on “Are top websites using WebGL for fingerprinting?”Submitted How insecure is Avast Secure Browser? as a story · 15 points
HN discussionLastPass does not use the secret key concept that 1Password uses, it only uses a key derived from your password. After the breach they rushed to increase the hash iterations [1] and added features to let enterprise admins set minimum iterations [2] but of course it was too late at that point. [1] https://palant.info/2022/12/28/lastpass-breach-the-significa... [2] https://support.lastpass.com/s/document-item?language…
Comment linking /2022/12/28/lastpass-breach-the-significance-of-these-password-iterations/
on “Feds Link Cyberheist to 2022 LastPass Hacks”Submitted TouchEn nxKey: The keylogging anti-keylogger solution as a story · 9 points
HN discussionWladimir Palant (original creator Adblock Plus and nowadays doing security work with a focus on browser extensions) has recently started a blog series on browser extension security: https://palant.info/2022/08/10/anatomy-of-a-basic-extension/
Comment linking /2022/08/10/anatomy-of-a-basic-extension/
on ““UBO Minus (MV3)” – An Experimental uBlock Origin Build for Manifest V3”Submitted Bitwarden Design Flaw as a story · 8 points
HN discussion
