22 ms·

The FBI now recommends using an ad blocker when searching the web

734 points by taubek 4y ago

autoexec 4y ago
Pretty late to the game there, FBI. There are examples going back decades of drive by downloads and exploits from ads on popular websites. It's not enough to avoid shady websites. Any website filled with ads is already a shady website.
- hsbauauvhabzb 4y ago
  Any good case studies to back this up? I’m interested to read more into it.
  - autoexec 4y ago
    Some older articles: https://www.pcworld.com/article/435020/hackers-make-driveby-download-attacks-stealthier-with-fileless-infections.html https://www.pcworld.com/article/435020/hackers-make-driveby-... https://money.cnn.com/2013/02/22/technology/security/nbc-com-hacked-malware/index.html https://money.cnn.com/2013/02/22/technology/security/nbc-com... https://blog.fox-it.com/2014/01/03/malicious-advertisements-served-via-yahoo/ https://blog.fox-it.com/2014/01/03/malicious-advertisements-... https://www.cbsnews.com/news/huffpo-readers-hit-with-ransomware-infected-ads/ https://www.cbsnews.com/news/huffpo-readers-hit-with-ransomw...
- Falkon1313 4y ago
  Yep. The only time I ever had a malware-infected computer it was one of those drive-bys. You didn't even have to click through the link to the site advertised at all, the browser would just go ahead and start prefetching it, so in case you did, it would seem quicker. And meanwhile the Adobe plugin would just happily start executing whatever code came from it. I had to thoroughly wipe my computer and the computers of two others that fell to the same malicious ads. Now ublock origin is standard and no Adobe products are allowed.
tech234a 4y ago
Official announcement, December 2022: https://www.ic3.gov/Media/Y2022/PSA221221 https://www.ic3.gov/Media/Y2022/PSA221221
- dredmorbius 4y ago
  Thanks for that. There was also an HN discussion at the time: <https://news.ycombinator.com/item?id=34095107 https://news.ycombinator.com/item?id=34095107>
saklash 4y ago
Over the years, marketing networks have been infiltrated by hackers who manipulate ads to spread malware. Since the ads were served through a host of web pages, the attackers could do damage to a victim’s computers in minutes. With an ad blocker, though, you can prevent this situation from happening to you.
westcort 4y ago
Any recommendations for a good ad blocker and other precautions to take?
- Zetice 4y ago
  On MacOS I like Little Snitch for OS level stuff, with some rule groups like ads_stevenblack and malwares_prigent.
- sys42590 4y ago
  I recommend uBlock Origin and the anti-malware DNS from Cloudflare
- bogwog 4y ago
  I use adnauseam (https://adnauseam.io/ https://adnauseam.io/), which is built on top of ublock origin, and it works pretty well. The generic nuclear option to hide terrible web design, bypass (some) paywalls, and improve performance 1000x is to disable javascript. ublock and adnauseam both have a button to disable all javascript on a page, which is handy when reading articles on sites filled with garbage.
  - krackers 4y ago
    >both have a button to disable all javascript on a page Be slightly careful, there's a known issue (limitation of Chrome really) where requests and javascript are not blocked in the first few seconds of launching a browser or an incognito window (you can test this yourself). And this is true even with "Suspend network activity until all filter lists are loaded" enabled, because I think it's some limitation on Chrome as to when exactly extensions get loaded. So if you do rely on javascript being disabled for safety, after a fresh launch or new incognito window, you should visit a safe webpage first before going to the risky one.
    - fl0ps 4y ago
      I'm going to just read "limitation on Chrome" as "purposely defective by design" as there's sufficient incentive to delay disabling to let a few telemetric squeaks escape.
halfjoking 4y ago
FBI must have infiltrated ad blocker servers containing malicious url lists. Never using an adblocker again.
- raydiatian 4y ago
  Username checks out.
- deleted 4y ago
  [deleted]
- shadowgovt 4y ago
  Using an adblocker based on Manifest v3 would avoid this, as those blockers can't phone home to update their malware datasets. ;)
  - cudgy 4y ago
    Is this not also the case when using iOS content blockers?
- TheSpiceIsLife 4y ago
  Huh, I always get down voted for saying something very similar. It's a rational assumption and should be taken in to consideration to the extent any particular threat-model should or shouldn't.
  - JasserInicide 4y ago
    Any serious schizo worth their weight would only be using an airgapped system at home and only connecting to the Internet from public APs with a completely separate computer.
- jeffbee 4y ago
  New! ANØM 2.0!
- whatgoodisaroad 4y ago
  I stopped using adblockers generally when I considered both 1) we get very little visibility on when an extension changes-hands/updates, combined with 2) you have to give it access to all your browsing data. People sell popular browser extensions to malicious parties all the time and AFAIK there's no systematic way to notify users when this happens.
TheSpiceIsLife 4y ago
Which we should probably take to mean at least some of the popular ad blockers are comprised to some degree in law enforcements favour. Just because I'm paranoid doesn't mean they're not out to get me ;)
lakomen 4y ago
Well too bad Google won't let you on the phone, Firefox at least allows you to install ublock.
- Zizizizz 4y ago
  Brave, Firefox, Bromite all do, or you can use nextdns or adguard as a private DNS in your network settings. I think the last option is a little wireguard set up to route traffic to a server or small pc that has unbound and pinhole on it
  - staringback 4y ago
    DNS adblocking isn't even remotely comparable to ublock origin
    - prima-facie 4y ago
      Can you please elaborate on this? thanks
      - drsnow 4y ago
        Pretty sure they are referring to cosmetic filtering which is not possible at a DNS level
      - Zizizizz 4y ago
        So for example YouTube serves their own ads so you can't skip YouTube ads with a DNS level adblock you need ublock origin which can block anything referenced in HTML which is why it works for skipping ads on YouTube.
      - jonas-w 4y ago
        For example you visit coolblog.org and it tries to load coolblog.org/ad.js dns blocking would only see the domain coolblog.org, and doesn't see that it loads ad.js, so it won't block anything. But e.g. uBlock, also sees that your browser tries to visit ad.js, if uBlock had ad.js in its blocklists it can block loading this script.
kerkeslager 4y ago
At this point it's irresponsible for browsers not to come with ad blocking preinstalled.
- freediver 4y ago
  You are correct ads have become popups of late 90s. Yet, very few browsers do, as most of them depend directly or indirectly on ad revenue. AFAIK only Orion browser [1] comes with full 1st party and 3rd party ad and tracker blocking, by default. [1] https://browser.kagi.com https://browser.kagi.com
  - Eisenstein 4y ago
    Brave browser is literally built to block ads.
    - freediver 4y ago
      Except that it does not block first party ads by default (and also makes money by serving their own first party ads to users).
      - Eisenstein 4y ago
        I don't see any ads. You can turn them off.
        freediver 4y ago
        You can not say a browser is built to block ads when showing ads is literally how it makes money. You maybe turned it off, but most people didn't. If everybody turned it off, it would not have a revenue stream.
        deleted 4y ago
        [deleted]
        4y ago
TacticalCoder 4y ago
Here are a few things I do to combat nasty websites: - blacklists entire domains using wildcards (using an "unbound" DNS resolver and forcing all traffic to my DNS resolver, preventing my browser to use DoH -- I can still then use DoH if I want, from unbound) - reject or drop a huge number of known bad actors, regularly updated: they go into gigantic "ip sets" firewall rules - (I came up with this one): use a little firewall rule that prevents any IDN from resolving. That's a one line UDP rule and it stops cold dead any IDN homograph attack. Basically searching any UDP packet for the "xn--" string. I do not care about what this breaks. The Web still works totally fine for me, including Google's G Suite (yeah, I know). EDIT: just to be clear seen the comments for I realize I wasn't very precise... I'm not saying all IDN domains are bad! What I'm saying is that in my day to day Web surfing, 99.99% of the websites I'm using do not use IDN and so, in my case, blocking IDN, up until today, is totally fine as it not only doesn't prevent me from surfing the Web (I haven't seen a single site I need breaking) but it also protects me from IDN homograph attacks. Your mileage may vary and you live in a country where it's normal to go on website with internationalized domain names, then obviously you cannot simply drop all UDP packets attempting to resolve IDNs.
- SahAssar 4y ago
  The last one is very anglo-centric (or at least centric to fully latinized languages). Do you not find the rules[0] in for example chrome working? [0]: https://chromium.googlesource.com/chromium/src/+/main/docs/idn.md https://chromium.googlesource.com/chromium/src/+/main/docs/i...
  - TacticalCoder 4y ago
    I'm not even a native english speaker and my native language does have accentuated characters so there's that... I don't like to have to set rules in browsers: I'll do it when mandatory but I prefer things that the browser won't change during it's next update and, also, I use several browsers.
  - tsimionescu 4y ago
    Very few countries, even outside the anglosphere, use IDNs.
drusepth 4y ago
Does anyone have any adblockers they recommend that still show "safe" ads (e.g. non-malware) by default, without having to whitelist every site? I'd be open to the security benefits of an adblocker if I could still passively support all the sites I visit. Edit: changed "good" to "safe" for clarity
- cinntaile 4y ago
  The problem is you can't tell the difference.
- cld8483 4y ago
  The only "good" ads are those you have to specifically go out of your way to view because you want to view them; such as product catalogues. All other ads are physiological assault and should be made illegal. Particularly those ads which exist "IRL" and can't otherwise be blocked, such as billboards.
  - wardedVibe 4y ago
    Waiting for the day when augmented reality glasses let you block irl ads. Realistically it'll be the opposite first of course.
    - alwayslikethis 4y ago
      I think the technology is actually more or less there already. We just need a few enterprising individuals to come up with a polished device for that.
      - cld8483 4y ago
        The device is the hard part. AR hardware that occludes the real word is a difficult challenge.
    - slater 4y ago
      Obligatory: https://youtu.be/YJg02ivYzSs?t=3 https://youtu.be/YJg02ivYzSs?t=3
VFIT7CTO77TOC 4y ago
It is infuriating that Google seems to be doing nothing about scam ads. For years I have been seeing "Click to install iPhone update!!!" ads on YouTube mobile. Easy to have huge profit margins when your company hires no humans to do things like customer support and ad vetting.
- junon 4y ago
  I still get ads for Slovenian brides on YouTube. Not only is it incredibly gross and objective to me, Google clearly knows nothing about my demographic.
  - prox 4y ago
    I still see extreme right wing propaganda on a pristine profile on YouTube’s flipping homepage. I would love to use expletives on the YT management right now, but I refrain.
- UberFly 4y ago
  Yea, I think we can all conclude they just don't care if it effects their bottom line. So short-sighted. About a month ago people in the AMD subreddit were complaining about compromised drivers and software appearing as the #1 search results due to these kind of ads.
- wlesieutre 4y ago
  There's been a series of malware distribution ads pretending to be blender.org popping up at the top of Google results on and off for months. 1 month ago: https://www.reddit.com/r/blender/comments/109yjxm/dont_click_on_ads_on_googles_bois/ https://www.reddit.com/r/blender/comments/109yjxm/dont_click... 2 months ago: https://www.reddit.com/r/blender/comments/zewem3/beware_of_phishing_when_trying_to_download_blender/ https://www.reddit.com/r/blender/comments/zewem3/beware_of_p... 4 months ago: https://www.reddit.com/r/blender/comments/xxkx5s/warning_somebody_is_renting_out_an_ad_space_on/ https://www.reddit.com/r/blender/comments/xxkx5s/warning_som... 7 months ago: https://www.reddit.com/r/blender/comments/vuqu1r/hey_so_whats_up_with_the_fake_blerdem3d_top/ https://www.reddit.com/r/blender/comments/vuqu1r/hey_so_what... Pretty sad state of affairs that Google can't or won't stop this, especially since they gradually redesigned the ads spots to look practically identical to the search results. Be very careful clicking anything on Google's search results.
annoyingnoob 4y ago
I think browser Notifications help drive these attacks. How many web sites do you visit that offer a pop-up that says the site would like to send you Notifications? You click Allow and suddenly start seeing Ads popup in your Notification area, not a site notification but an Ad. I had a user show me one of these Notification ads just this week, telling here that McAfee found a virus and click the Ad to remove the virus. We do not even use McAfee, it was a straight up attack ad. Thanks Chrome!
rmason 4y ago
Is it time for an open source adblocker that only blocks bad actors? I am perfectly fine with ads, I've previously run sites where it was a small source of income myself. I know it would be in a cat and mouse game with the bad guys but if it blocked most of them it would certainly help a lot of people.
- WirelessGigabit 4y ago
  Let's build that company that serves ads and blocks bad actors. We can then offer the blocklist to other blockers. Problems: * vetting ads costs a lot of time (= money). So you're getting less money per impression * requires a massive amount of infrastructure if you want to ensure that the ad doesn't change in between you vetting it and you serving it to your clients (= money). Meaning the consumers of our company will get less money per ad they show to their visitors. So they'll go to one that offers more. Simple as that. In order to fix the bad actors we need to start making the websites serving the ads (like Reddit) and/or the networks (DoubleClick) responsible for what they offer up. As long as that doesn't happen it'll remain a cesspool.
- newaccount2021 4y ago
  [dead]
- bee_rider 4y ago
  It is already a cat and mouse game, adding another handicap for the good guys seems like too much. Plus, perverse incentives might creep in on the “bad actor” definition.
- wardedVibe 4y ago
  Brave does this, to some degree, but then you have to endorse crypto as the means of solving the monetization problem.
- faeriechangling 4y ago
  Adblock Plus is already like this and everybody technical quickly realised the reality of an advertising "Whitelist" instantly creates a de facto protection racket where getting an exclusion from the adblocker becomes a valuable commodity. It's worth paying WHATEVER the adblock operator is asking to get on the whitelist. Adblock Plus got big bucks from Google who in turn have saved billions from striking a deal with them. The small guys - well they got screwed - you need to go through certain well financed ad networks to deliver "Acceptable ads". Adblock Plus is still popular for some reason but I don't know any technical people who still use it because well it's corrupt and hostile to its own users and has a clear drop-in replacement. In the opinion of the vast majority of adblocker users, agree with it or not, ALL advertisers are bad actors. So they will never voluntarily choose filter lists which allow "good ads" the vast majority of the time. As such this will only happen if you get the adblocker to set allowing "acceptable ads" as a default, which makes what you're talking about INTRINSICALLY corrupt and paternalistic. If you want people to actually do this, show up at the houses of Adblock developers with suitcases of money, plenty of drugs, and beautiful prostitutes and whisper sweet stories into their ears about how they can help small businesses find markets for their products. Sadly ublock origin's developers appear to be incorruptible. Google has figured out trying to push "acceptable ads" any harder is pointless and has instead moved to simply make adblocking technically harder to do by taking control of web standards.
Animats 4y ago
Make ad brokers share responsibility for losses due to scam ads. If the ad broker is unable to clearly identify the advertiser for lawsuit purposes, the ad broker should face consequences. They're assisting the criminal by helping them hide.
- NetOpWibby 4y ago
  I like this
  - Animats 4y ago
    Some businesses useful to criminals have extra requirements for identifying customers. Pawn shops. Junk yards. Auctioneers. Auction services and ad brokers should be added to that list.
- sircastor 4y ago
  Maybe I’m naive here, but aren’t the vast majority of ads brokered by Meta and Google these days? Am I thinking too high level?
  - BLKNSLVR 4y ago
    Google and Meta seem to have no idea what's going on within their own advertising networks. Similarly to all the stories (with two currently in the front page of HN, eBay and PayPal) about algorithms that are just insufficient for the range of realistic scenarios these companies must deal with on a regular basis. It's merely the equation of profit outweighing customer service. Admittedly, they're working on a scale that's difficult to comprehend, but that shouldn't absolve them of aiding and abetting criminal use of their systems. Google's and Meta's profit motives are the base cause of this continuing escalation of the ubiquity and user-hostility (to put it mildly) of internet advertising. It's only been predictable for the last 20 years... https://youtu.be/YlGklt4BSQ8 https://youtu.be/YlGklt4BSQ8 (first aired in March 2000) https://youtu.be/XPGgTy5YJ-g https://youtu.be/XPGgTy5YJ-g (April 1999)
    - 4y ago
cheapliquor 4y ago
FBI said I can have a little uBlock Origin As a treat
elecush 4y ago
FBI's chief export: software suggestions
radium3d 4y ago
hehe makes sense to send all the pages you visit to the FBI/NSA, etc. If they have multiple sources (DNS and AdBlockers, VPNS, etc. They can verify the data on one or the other.
madars 4y ago
Or, in other words, FBI now recommends using Android :-) It's baffling how much better uBlock Origin + Firefox experience on Android is compared to any iOS ad blocker I have tried. They kind-of work but let half of the ads through.
- poglet 4y ago
  Not comparable but NextDNS has been working well for me on iOS.
  - comprev 4y ago
    NextDNS works for 95% of the web I visit. AdGuard iOS plugin works on Facebook's mobile web app for when I rarely use it.
- dcdc123 4y ago
  Brave browser on iOS has good blocking, but the browser experience itself is a bit of a mixed bag.
  - kmlx 4y ago
    i’ve used this one for years: https://apps.apple.com/gb/app/wipr/id1030595027 https://apps.apple.com/gb/app/wipr/id1030595027 no issues, works great.
    - walterbell 4y ago
      Another vote for Wipr on iOS for Safari ad blocking. For system wide (including apps) ad blocking, Lockdown has a "local VPN".
  - nixass 4y ago
    Browser experience is shite like any other Safari wrapped abomination
- mlindner 4y ago
  Do all the people who use computers to browse the internet (the majority of people on the internet) suddenly no longer exist?
deleted 4y ago
[deleted]
tomohawk 4y ago
They don't like the competition.
1vuio0pswjnm7 4y ago
(2022)
- dredmorbius 4y ago
  Generally HN doesn't require a year for articles less than 6 months old or so. Though yes, this story dates from December and was covered at the time (from a different source): <https://news.ycombinator.com/item?id=34095107 https://news.ycombinator.com/item?id=34095107>
PaulHoule 4y ago
I think FBI also would tell you to stay away from sites that mess with the back button.
thefourthchime 4y ago
Due to recent events, maybe didn't use the duckduckgo one.
paxys 4y ago
Those who are a bit tech minded – consider adding DNS filtering on your home network (using pi-hole or something else). It has drastically changed my web experience for the better, including across iPhone apps, smart TVs and other surfaces where ad blockers can't help.
- rrrrrrrrrrrryan 4y ago
  I see this advice a lot but I can't imagine it working better than using a system level adblocker like AdAway on my phone. (Smart TVs I understand, though mine seem to be unusually ad-less compared to what I've heard Samsung does). What if you're out and about disconnected from WiFi? What if you need to turn the thing off for a sec to click on a sale/promotion in an email?
  - paxys 4y ago
    What system level adblocker works on iOS?
    - rrrrrrrrrrrryan 4y ago
      Not sure - I haven't owned an Apple device since an iPod circa 2007. Do iPhones still really not have a way to block in-app ads?
      - sbuk 4y ago
        https://1blocker.com/ https://1blocker.com/ Is a system wide ad blocker. It’s not uBlock Origin in terms of coverage, but extremely close and it work on all apps.
  - akoumis 4y ago
    Out and about: yeah install something on your phone (or use a self hosted vpn that plugs into pihole? never tried it) Need to click on sale: You can easily temporarily disable it in the web interface in 1 click It's a nice way to block ads for any wifi connected device in your house without additional setup. There are probably 10+ ad-serving devices in my house between the TV's, laptops, tablets, and phones.
panny 4y ago
I am puzzled here. Why is the FBI expecting the free market to solve the problem created by the free market? Are these scams somehow legal? If the scam is illegal, and search engines are promoting the scams at the top of search rankings, doesn't that make the search engine an accomplice in the scam? If I invited crack dealers to deal out of my house for a small cut of the proceeds, I'm pretty sure I go to jail when they're caught. That's essentially what search engines are doing here.
- deleted 4y ago
  [deleted]
dredmorbius 4y ago
Discussed on HN at the time (2 months ago), via TechCrunch: <https://news.ycombinator.com/item?id=34095107 https://news.ycombinator.com/item?id=34095107> (36 comments).
PeterisP 4y ago
The same applies to corporate networks - there is no good reason why the default office computer installations for your employees should have a browser without an ad blocker, there are some (not huge, but some) security benefits that make it a reasonable IT policy almost everywhere.
- hsbauauvhabzb 4y ago
  Protip: sell it to exec as a productivity bonus, the reduced cognitive load and accidental missclick a would add up in any medium of large business.
- incompatible 4y ago
  In the case of the FBI, et. al., who according to the article "are already reportedly using network-based ad-blocking technologies", I'd wonder if not being able to access certain material would hinder the investigation of scams.
71a54xd 4y ago
Sure, but ad-blockers are also basically adware that scans through the entirety of all websites you visit. Very similar snooping to custom keyboards etc...
- yjftsjthsd-h 4y ago
  > but ad-blockers are also basically adware that scans through the entirety of all websites you visit. Very similar snooping to custom keyboards etc... Er, not as a group they aren't. Like, I'm sure there are bad adblockers, but if you stick with uBlock Origin you'll be fine.
  - 71a54xd 4y ago
    Why wouldn't uBlock Origin be targeted? Nobody is capable of auditing the entire codebase, paying off open source contributors flat out isn't hard and it's cheap.
userbinator 4y ago
I wonder when/if they'll also recommend JS whitelisting. The majority of browser exploits rquire JS to function, and even the occasional few which don't are likely going to be obfuscated using JS to avoid easy detection.
emacdona 4y ago
I recommend using an ad-blocker while visiting that site :-/ Lately, I find myself using more and more plugins to make the "modern web" tolerable. To list a few: Channel Blocker (lets me block channels from search results on Youtube); uBlock Origin; Disconnect; F.B Purity; Consent-O-Matic (auto fill cookie consent forms); Kagi Search; PopUpOFF; Facebook Container; Privacy Badger; ClearURLs; Return YouTube Dislike Basically, if I visit a website and don't like the experience, I either never go back (Kagi lets me exclude it from search results) or find a plugin to make it tolerable. What I really want now is the ability to exclude entire websites from any permissions I grant to plugins. I feel like in the last year, I've read a couple stories about companies buying successful plugins and then using them to track you or show ads or whatever. I'm worried this will be the next stage in the battle for our attention -- best case: companies will buy popular plugins to track us and show us intrusive ads; worst case: nefarious actors will buy them to scrape information we think is private and collect it. IE: I just want to be able to say "Hey, Firefox... those permissions that I granted to plugins x, y, and z? They don't apply to www.myfavoritebank.example.com" Is there a browser that has that feature yet? I spent a few hours trying to figure out if Firefox did. It did not appear to. edit: Added semicolons to separate plugins in list b/c HN stripped the newlines from my comment.
- Groxx 4y ago
  Yeah, the permission model in browser plugins is all kinds of messed up. In absolutely no way is it the plugin's decision where it should be allowed to run. It's great if it self-restricts and we should encourage that, but it's absurd in the extreme that any version of plugin support ever shipped without a way for users to override and restrict them further. Trusting the author of a thing to do what they claim to do is literal security insanity, and it always has been. Chrome is sightly improving here, with click-to-activate extensions, but it's still pretty far from just giving me a frickin list field.
- kfoley 4y ago
  > Is there a browser that has that feature yet? I spent a few hours trying to figure out if Firefox did. It did not appear to. I believe this will be supported by manifest v3 extensions in Firefox[1] which is one of the features I'm looking forward to for the same reason. [1]: https://blog.mozilla.org/addons/2022/10/31/begin-your-mv3-migration-by-implementing-new-features-today/ https://blog.mozilla.org/addons/2022/10/31/begin-your-mv3-mi...
gerdesj 4y ago
I rarely see ads. pfblocker-ng at the router. Privacy Badger lumbers alongside uBlacklist on the browser.
wankle 4y ago
uBlock Origin seems popular so I checked what permissions the Chrome Web Store says it needs: "Read and change all your data on all websites" "Change your privacy-related settings" It feels like this could give the US Government one stop shopping to ... me. Oh boy, I get my Christmas Goose early this year!
- genmud 4y ago
  Do tell me how you can block/remove ads from pages without having read and change?
ravenstine 4y ago
Why should we take advice from the FBI?
- deleted 4y ago
  [deleted]
- Nemo_bis 4y ago
  I don't, but Google is presumably not pleased to hear the FBI say "Cyber criminals purchase advertisements that appear within internet search results". https://www.ic3.gov/Media/Y2022/PSA221221 https://www.ic3.gov/Media/Y2022/PSA221221 The FTC, other regulators or courts in the countless cases against Google may also use such a statement as validation that fraud is rampant.
dngray 4y ago
> Disconnect, Privacy Badger, ClearURLs https://github.com/arkenfox/user.js/wiki/4.1-Extensions#-dont-bother https://github.com/arkenfox/user.js/wiki/4.1-Extensions#-don... Really these days about the only privacy extension you might need is uBO and possibly CanvasBlocker if you haven't set RFP. https://support.mozilla.org/en-US/kb/firefox-protection-against-fingerprinting https://support.mozilla.org/en-US/kb/firefox-protection-agai...
dngray 4y ago
One of the most important things you can do is enable ETP, (Enhanced Tracking Protection), set that to "Strict" and enable sanitizing on close: We have instructions for that https://www.privacyguides.org/desktop-browsers/#firefox https://www.privacyguides.org/desktop-browsers/#firefox
- exodust 4y ago
  I'd recommend expanding the browser configuration information on your site to include the options found under about:config. There's a bunch of settings in there not available under the main settings. Eg privacy.resistFingerprinting -- which actually has a bug where your browser suddenly stops opening full screen, even with this setting disabled. Solution is to toggle this setting on and off, restarting browser between toggles, and Firefox will remember to open full screen again next time if that's how you left it.
untangle 4y ago
This is interesting but it's old news. Both the linked article and the "FBI PSA" are dated late December of 2022.
errantmind 4y ago
There are a lot of great addons that improve browsing immensely. I'll dump mine: * ublock origin: block ads * uBlacklist: block domains from Google search results * SponsorBlock: skip sponsored segments in youtube videos * Thumbnail Rating Bar for YouTube™: show a rating bar along the bottom of each YouTube search result * Firefox Multi-Account containers: Site storage segmentation * Bypass Paywalls Clean: bypass site paywalls (mostly news) * Clear URLs: clean tracking / referrals from URLs * TTV LOL: block some Twitch ads * ViolentMonkey: Greasemonkey scripts for further site customization
- timbit42 4y ago
  Bypass Paywalls Clean is no longer on the Firefox add-ons website. You have to get updates here: https://gitlab.com/magnolia1234/bypass-paywalls-firefox-clean/-/releases https://gitlab.com/magnolia1234/bypass-paywalls-firefox-clea...
deleted 4y ago
[deleted]
vinay_ys 4y ago
It is simultaneously impressive and sad and hilarious that security of millions of people depend on the work of one volunteer software developer (gorhill – ublock origin) and a bunch of volunteer block-list maintainers.
- geraldhh 4y ago
  true then again, mainstream computing as a hole is largely built upon volunteer work as linux and open source are the basis of mobile _and_ cloud.
CyberSimon 4y ago
Anyone find it amusing that a UK site has to report on United States FBI recommendations...?
worldsavior 4y ago
Removing ads only makes you more unique. As most users don't block ads, by using an ad blocker sites can identify you more by knowing you use an ad blocker. It is more comfortable, but it's preferred using a wide DNS ad blocker as sites can only know that for some reason the DNS server can't resolve their domains. DNS ad blocker can also increase uniqueness. Using an ad blocker extension can also cause security issues, as the extension has full control on network traffic and has potential to be exploited.
- nix23 4y ago
  >Using an ad blocker extension can also cause security issues, But loading ad's are the much greater security issue. And if you care about "uniqueness" you have that already with your IP, so you should start there with yourOwnVPN, TOR etc.
  - worldsavior 4y ago
    > But loading ad's are the much greater security issue. How so? You're just retrieving the data and displaying it. > And if you care about "uniqueness" you have that already with your IP There are many ISP's that use NAT to save IP addresses, hence an IP is not really an identifier. Even if not, an IP is identifieing the all network, and all the ones that are connected to the same network. You can see how in YouTube (incognito mode) you will always get personalized videos based on your IP approximate geolocation (usually just the state) if it's your first time.
    - nix23 4y ago
      >How so? You're just retrieving the data and displaying it. Yeah displaying data...that cant be dangerous ;) >There are many ISP's that use NAT to save IP addresses, hence an IP is not really an identifier. Do you really think your argumentation is good?
      - worldsavior 4y ago
        > Yeah displaying data...that cant be dangerous ;) It's not dangerous because it's coming from a good source, such as google ads. > Do you really think your argumentation is good? Yes, because that's what happens. I don't really think an IP is a good identifier because it's shared by others. Using cookies is a much better option.
sergiogjr 4y ago
Using Brave Browser and never looked back. I use MSEdge for work stuff (client testing as it's their default). It was vanilla, but recently I had to install uBlock (minimum). It was too unbearable to do a simple search for some technical info and end up on a website that would LITERALLY slow the OS as a whole due to spike on Edge's CPU and memory usage.
singeezie 4y ago
Misleading consents
dustedcodes 4y ago
That’s quite significant if the situation got so bad that even the FBI recommends a practice now which will arguably harm the profits of some of America’s largest corporations.
exodust 4y ago
The FBI page in question[0] (I hope ic3.gov is legit!) says "Before clicking on an advertisement, check the URL to make sure the site is authentic." But on a mobile device nobody knows how to do that. And the URL will be some kind of ad redirect a mile long. FBI: "Rather than search...type the business’s URL into an internet browser’s address bar..." I'm not sure about this one. Typos easily happen, and it's the typo'd domain that scammers might own. Risky whatever way you go I suppose. For well known businesses I'd rather search and click on organic links than trust my own typing of a URL. "Use an ad blocking extension". Third time's the charm. Great to see this advice coming from the FBI. https://www.ic3.gov/Media/Y2022/PSA221221 https://www.ic3.gov/Media/Y2022/PSA221221
- silon42 4y ago
  Yeah, it's been a long time outstanding to ban redirects to other domains.
walrus01 4y ago
I can't believe people use mobile browsers now that are not Firefox. Firefox on Android can have the full powered ublock origin addon installed in it. Same as desktop. It makes things so much better.
Kailhus 4y ago
This does make me wonder, is there any extension that can modify the DOM? I.e remove nodes aka a div container by className or change css and make it persist?
jiveturkey 4y ago
why only when searching?
puffoflogic 4y ago
The next major move in the adblocking wars will be to get them declared illegal. You heard it here first.
junaid1460 4y ago
Must’ve cracked deal with the blocker plugins

734 points by taubek 4y ago

Pretty late to the game there, FBI. There are examples going back decades of drive by downloads and exploits from ads on popular websites. It's not enough to avoid shady websites. Any website filled with ads is already a shady website.

hsbauauvhabzb 4y ago
Any good case studies to back this up? I’m interested to read more into it.
- autoexec 4y ago
  Some older articles: https://www.pcworld.com/article/435020/hackers-make-driveby-download-attacks-stealthier-with-fileless-infections.html https://www.pcworld.com/article/435020/hackers-make-driveby-... https://money.cnn.com/2013/02/22/technology/security/nbc-com-hacked-malware/index.html https://money.cnn.com/2013/02/22/technology/security/nbc-com... https://blog.fox-it.com/2014/01/03/malicious-advertisements-served-via-yahoo/ https://blog.fox-it.com/2014/01/03/malicious-advertisements-... https://www.cbsnews.com/news/huffpo-readers-hit-with-ransomware-infected-ads/ https://www.cbsnews.com/news/huffpo-readers-hit-with-ransomw...
Falkon1313 4y ago
Yep. The only time I ever had a malware-infected computer it was one of those drive-bys. You didn't even have to click through the link to the site advertised at all, the browser would just go ahead and start prefetching it, so in case you did, it would seem quicker. And meanwhile the Adobe plugin would just happily start executing whatever code came from it. I had to thoroughly wipe my computer and the computers of two others that fell to the same malicious ads. Now ublock origin is standard and no Adobe products are allowed.

tech234a 4y ago

Official announcement, December 2022: https://www.ic3.gov/Media/Y2022/PSA221221 https://www.ic3.gov/Media/Y2022/PSA221221

dredmorbius 4y ago
Thanks for that. There was also an HN discussion at the time: <https://news.ycombinator.com/item?id=34095107 https://news.ycombinator.com/item?id=34095107>

saklash 4y ago

Over the years, marketing networks have been infiltrated by hackers who manipulate ads to spread malware. Since the ads were served through a host of web pages, the attackers could do damage to a victim’s computers in minutes. With an ad blocker, though, you can prevent this situation from happening to you.

westcort 4y ago

Any recommendations for a good ad blocker and other precautions to take?

Zetice 4y ago
On MacOS I like Little Snitch for OS level stuff, with some rule groups like ads_stevenblack and malwares_prigent.
sys42590 4y ago
I recommend uBlock Origin and the anti-malware DNS from Cloudflare
bogwog 4y ago
I use adnauseam (https://adnauseam.io/ https://adnauseam.io/), which is built on top of ublock origin, and it works pretty well. The generic nuclear option to hide terrible web design, bypass (some) paywalls, and improve performance 1000x is to disable javascript. ublock and adnauseam both have a button to disable all javascript on a page, which is handy when reading articles on sites filled with garbage.
- krackers 4y ago
  >both have a button to disable all javascript on a page Be slightly careful, there's a known issue (limitation of Chrome really) where requests and javascript are not blocked in the first few seconds of launching a browser or an incognito window (you can test this yourself). And this is true even with "Suspend network activity until all filter lists are loaded" enabled, because I think it's some limitation on Chrome as to when exactly extensions get loaded. So if you do rely on javascript being disabled for safety, after a fresh launch or new incognito window, you should visit a safe webpage first before going to the risky one.
  - fl0ps 4y ago
    I'm going to just read "limitation on Chrome" as "purposely defective by design" as there's sufficient incentive to delay disabling to let a few telemetric squeaks escape.

halfjoking 4y ago

FBI must have infiltrated ad blocker servers containing malicious url lists. Never using an adblocker again.

raydiatian 4y ago
Username checks out.
deleted 4y ago
[deleted]
shadowgovt 4y ago
Using an adblocker based on Manifest v3 would avoid this, as those blockers can't phone home to update their malware datasets. ;)
- cudgy 4y ago
  Is this not also the case when using iOS content blockers?
TheSpiceIsLife 4y ago
Huh, I always get down voted for saying something very similar. It's a rational assumption and should be taken in to consideration to the extent any particular threat-model should or shouldn't.
- JasserInicide 4y ago
  Any serious schizo worth their weight would only be using an airgapped system at home and only connecting to the Internet from public APs with a completely separate computer.
jeffbee 4y ago
New! ANØM 2.0!
whatgoodisaroad 4y ago
I stopped using adblockers generally when I considered both 1) we get very little visibility on when an extension changes-hands/updates, combined with 2) you have to give it access to all your browsing data. People sell popular browser extensions to malicious parties all the time and AFAIK there's no systematic way to notify users when this happens.

TheSpiceIsLife 4y ago

Which we should probably take to mean at least some of the popular ad blockers are comprised to some degree in law enforcements favour. Just because I'm paranoid doesn't mean they're not out to get me ;)

lakomen 4y ago

Well too bad Google won't let you on the phone, Firefox at least allows you to install ublock.

Zizizizz 4y ago
Brave, Firefox, Bromite all do, or you can use nextdns or adguard as a private DNS in your network settings. I think the last option is a little wireguard set up to route traffic to a server or small pc that has unbound and pinhole on it
- staringback 4y ago
  DNS adblocking isn't even remotely comparable to ublock origin
  - prima-facie 4y ago
    Can you please elaborate on this? thanks
    - drsnow 4y ago
      Pretty sure they are referring to cosmetic filtering which is not possible at a DNS level
    - Zizizizz 4y ago
      So for example YouTube serves their own ads so you can't skip YouTube ads with a DNS level adblock you need ublock origin which can block anything referenced in HTML which is why it works for skipping ads on YouTube.
    - jonas-w 4y ago
      For example you visit coolblog.org and it tries to load coolblog.org/ad.js dns blocking would only see the domain coolblog.org, and doesn't see that it loads ad.js, so it won't block anything. But e.g. uBlock, also sees that your browser tries to visit ad.js, if uBlock had ad.js in its blocklists it can block loading this script.

kerkeslager 4y ago

At this point it's irresponsible for browsers not to come with ad blocking preinstalled.

freediver 4y ago
You are correct ads have become popups of late 90s. Yet, very few browsers do, as most of them depend directly or indirectly on ad revenue. AFAIK only Orion browser [1] comes with full 1st party and 3rd party ad and tracker blocking, by default. [1] https://browser.kagi.com https://browser.kagi.com
- Eisenstein 4y ago
  Brave browser is literally built to block ads.
  - freediver 4y ago
    Except that it does not block first party ads by default (and also makes money by serving their own first party ads to users).
    - Eisenstein 4y ago
      I don't see any ads. You can turn them off.
      - freediver 4y ago
        You can not say a browser is built to block ads when showing ads is literally how it makes money. You maybe turned it off, but most people didn't. If everybody turned it off, it would not have a revenue stream.
        deleted 4y ago
        [deleted]
        4y ago

TacticalCoder 4y ago

Here are a few things I do to combat nasty websites: - blacklists entire domains using wildcards (using an "unbound" DNS resolver and forcing all traffic to my DNS resolver, preventing my browser to use DoH -- I can still then use DoH if I want, from unbound) - reject or drop a huge number of known bad actors, regularly updated: they go into gigantic "ip sets" firewall rules - (I came up with this one): use a little firewall rule that prevents any IDN from resolving. That's a one line UDP rule and it stops cold dead any IDN homograph attack. Basically searching any UDP packet for the "xn--" string. I do not care about what this breaks. The Web still works totally fine for me, including Google's G Suite (yeah, I know). EDIT: just to be clear seen the comments for I realize I wasn't very precise... I'm not saying all IDN domains are bad! What I'm saying is that in my day to day Web surfing, 99.99% of the websites I'm using do not use IDN and so, in my case, blocking IDN, up until today, is totally fine as it not only doesn't prevent me from surfing the Web (I haven't seen a single site I need breaking) but it also protects me from IDN homograph attacks. Your mileage may vary and you live in a country where it's normal to go on website with internationalized domain names, then obviously you cannot simply drop all UDP packets attempting to resolve IDNs.

SahAssar 4y ago
The last one is very anglo-centric (or at least centric to fully latinized languages). Do you not find the rules[0] in for example chrome working? [0]: https://chromium.googlesource.com/chromium/src/+/main/docs/idn.md https://chromium.googlesource.com/chromium/src/+/main/docs/i...
- TacticalCoder 4y ago
  I'm not even a native english speaker and my native language does have accentuated characters so there's that... I don't like to have to set rules in browsers: I'll do it when mandatory but I prefer things that the browser won't change during it's next update and, also, I use several browsers.
- tsimionescu 4y ago
  Very few countries, even outside the anglosphere, use IDNs.

drusepth 4y ago

Does anyone have any adblockers they recommend that still show "safe" ads (e.g. non-malware) by default, without having to whitelist every site? I'd be open to the security benefits of an adblocker if I could still passively support all the sites I visit. Edit: changed "good" to "safe" for clarity

cinntaile 4y ago
The problem is you can't tell the difference.
cld8483 4y ago
The only "good" ads are those you have to specifically go out of your way to view because you want to view them; such as product catalogues. All other ads are physiological assault and should be made illegal. Particularly those ads which exist "IRL" and can't otherwise be blocked, such as billboards.
- wardedVibe 4y ago
  Waiting for the day when augmented reality glasses let you block irl ads. Realistically it'll be the opposite first of course.
  - alwayslikethis 4y ago
    I think the technology is actually more or less there already. We just need a few enterprising individuals to come up with a polished device for that.
    - cld8483 4y ago
      The device is the hard part. AR hardware that occludes the real word is a difficult challenge.
  - slater 4y ago
    Obligatory: https://youtu.be/YJg02ivYzSs?t=3 https://youtu.be/YJg02ivYzSs?t=3

VFIT7CTO77TOC 4y ago

It is infuriating that Google seems to be doing nothing about scam ads. For years I have been seeing "Click to install iPhone update!!!" ads on YouTube mobile. Easy to have huge profit margins when your company hires no humans to do things like customer support and ad vetting.

junon 4y ago
I still get ads for Slovenian brides on YouTube. Not only is it incredibly gross and objective to me, Google clearly knows nothing about my demographic.
- prox 4y ago
  I still see extreme right wing propaganda on a pristine profile on YouTube’s flipping homepage. I would love to use expletives on the YT management right now, but I refrain.
UberFly 4y ago
Yea, I think we can all conclude they just don't care if it effects their bottom line. So short-sighted. About a month ago people in the AMD subreddit were complaining about compromised drivers and software appearing as the #1 search results due to these kind of ads.
wlesieutre 4y ago
There's been a series of malware distribution ads pretending to be blender.org popping up at the top of Google results on and off for months. 1 month ago: https://www.reddit.com/r/blender/comments/109yjxm/dont_click_on_ads_on_googles_bois/ https://www.reddit.com/r/blender/comments/109yjxm/dont_click... 2 months ago: https://www.reddit.com/r/blender/comments/zewem3/beware_of_phishing_when_trying_to_download_blender/ https://www.reddit.com/r/blender/comments/zewem3/beware_of_p... 4 months ago: https://www.reddit.com/r/blender/comments/xxkx5s/warning_somebody_is_renting_out_an_ad_space_on/ https://www.reddit.com/r/blender/comments/xxkx5s/warning_som... 7 months ago: https://www.reddit.com/r/blender/comments/vuqu1r/hey_so_whats_up_with_the_fake_blerdem3d_top/ https://www.reddit.com/r/blender/comments/vuqu1r/hey_so_what... Pretty sad state of affairs that Google can't or won't stop this, especially since they gradually redesigned the ads spots to look practically identical to the search results. Be very careful clicking anything on Google's search results.

annoyingnoob 4y ago

I think browser Notifications help drive these attacks. How many web sites do you visit that offer a pop-up that says the site would like to send you Notifications? You click Allow and suddenly start seeing Ads popup in your Notification area, not a site notification but an Ad. I had a user show me one of these Notification ads just this week, telling here that McAfee found a virus and click the Ad to remove the virus. We do not even use McAfee, it was a straight up attack ad. Thanks Chrome!

rmason 4y ago

Is it time for an open source adblocker that only blocks bad actors? I am perfectly fine with ads, I've previously run sites where it was a small source of income myself. I know it would be in a cat and mouse game with the bad guys but if it blocked most of them it would certainly help a lot of people.

WirelessGigabit 4y ago
Let's build that company that serves ads and blocks bad actors. We can then offer the blocklist to other blockers. Problems: * vetting ads costs a lot of time (= money). So you're getting less money per impression * requires a massive amount of infrastructure if you want to ensure that the ad doesn't change in between you vetting it and you serving it to your clients (= money). Meaning the consumers of our company will get less money per ad they show to their visitors. So they'll go to one that offers more. Simple as that. In order to fix the bad actors we need to start making the websites serving the ads (like Reddit) and/or the networks (DoubleClick) responsible for what they offer up. As long as that doesn't happen it'll remain a cesspool.
newaccount2021 4y ago
[dead]
bee_rider 4y ago
It is already a cat and mouse game, adding another handicap for the good guys seems like too much. Plus, perverse incentives might creep in on the “bad actor” definition.
wardedVibe 4y ago
Brave does this, to some degree, but then you have to endorse crypto as the means of solving the monetization problem.
faeriechangling 4y ago
Adblock Plus is already like this and everybody technical quickly realised the reality of an advertising "Whitelist" instantly creates a de facto protection racket where getting an exclusion from the adblocker becomes a valuable commodity. It's worth paying WHATEVER the adblock operator is asking to get on the whitelist. Adblock Plus got big bucks from Google who in turn have saved billions from striking a deal with them. The small guys - well they got screwed - you need to go through certain well financed ad networks to deliver "Acceptable ads". Adblock Plus is still popular for some reason but I don't know any technical people who still use it because well it's corrupt and hostile to its own users and has a clear drop-in replacement. In the opinion of the vast majority of adblocker users, agree with it or not, ALL advertisers are bad actors. So they will never voluntarily choose filter lists which allow "good ads" the vast majority of the time. As such this will only happen if you get the adblocker to set allowing "acceptable ads" as a default, which makes what you're talking about INTRINSICALLY corrupt and paternalistic. If you want people to actually do this, show up at the houses of Adblock developers with suitcases of money, plenty of drugs, and beautiful prostitutes and whisper sweet stories into their ears about how they can help small businesses find markets for their products. Sadly ublock origin's developers appear to be incorruptible. Google has figured out trying to push "acceptable ads" any harder is pointless and has instead moved to simply make adblocking technically harder to do by taking control of web standards.

Animats 4y ago

Make ad brokers share responsibility for losses due to scam ads. If the ad broker is unable to clearly identify the advertiser for lawsuit purposes, the ad broker should face consequences. They're assisting the criminal by helping them hide.

NetOpWibby 4y ago
I like this
- Animats 4y ago
  Some businesses useful to criminals have extra requirements for identifying customers. Pawn shops. Junk yards. Auctioneers. Auction services and ad brokers should be added to that list.
sircastor 4y ago
Maybe I’m naive here, but aren’t the vast majority of ads brokered by Meta and Google these days? Am I thinking too high level?
- BLKNSLVR 4y ago
  Google and Meta seem to have no idea what's going on within their own advertising networks. Similarly to all the stories (with two currently in the front page of HN, eBay and PayPal) about algorithms that are just insufficient for the range of realistic scenarios these companies must deal with on a regular basis. It's merely the equation of profit outweighing customer service. Admittedly, they're working on a scale that's difficult to comprehend, but that shouldn't absolve them of aiding and abetting criminal use of their systems. Google's and Meta's profit motives are the base cause of this continuing escalation of the ubiquity and user-hostility (to put it mildly) of internet advertising. It's only been predictable for the last 20 years... https://youtu.be/YlGklt4BSQ8 https://youtu.be/YlGklt4BSQ8 (first aired in March 2000) https://youtu.be/XPGgTy5YJ-g https://youtu.be/XPGgTy5YJ-g (April 1999)
  - 4y ago

cheapliquor 4y ago

FBI said I can have a little uBlock Origin As a treat

elecush 4y ago

FBI's chief export: software suggestions

radium3d 4y ago

hehe makes sense to send all the pages you visit to the FBI/NSA, etc. If they have multiple sources (DNS and AdBlockers, VPNS, etc. They can verify the data on one or the other.

madars 4y ago

Or, in other words, FBI now recommends using Android :-) It's baffling how much better uBlock Origin + Firefox experience on Android is compared to any iOS ad blocker I have tried. They kind-of work but let half of the ads through.

poglet 4y ago
Not comparable but NextDNS has been working well for me on iOS.
- comprev 4y ago
  NextDNS works for 95% of the web I visit. AdGuard iOS plugin works on Facebook's mobile web app for when I rarely use it.
dcdc123 4y ago
Brave browser on iOS has good blocking, but the browser experience itself is a bit of a mixed bag.
- kmlx 4y ago
  i’ve used this one for years: https://apps.apple.com/gb/app/wipr/id1030595027 https://apps.apple.com/gb/app/wipr/id1030595027 no issues, works great.
  - walterbell 4y ago
    Another vote for Wipr on iOS for Safari ad blocking. For system wide (including apps) ad blocking, Lockdown has a "local VPN".
- nixass 4y ago
  Browser experience is shite like any other Safari wrapped abomination
mlindner 4y ago
Do all the people who use computers to browse the internet (the majority of people on the internet) suddenly no longer exist?

deleted 4y ago

[deleted]

tomohawk 4y ago

They don't like the competition.

1vuio0pswjnm7 4y ago

(2022)

dredmorbius 4y ago
Generally HN doesn't require a year for articles less than 6 months old or so. Though yes, this story dates from December and was covered at the time (from a different source): <https://news.ycombinator.com/item?id=34095107 https://news.ycombinator.com/item?id=34095107>

PaulHoule 4y ago

I think FBI also would tell you to stay away from sites that mess with the back button.

thefourthchime 4y ago

Due to recent events, maybe didn't use the duckduckgo one.

paxys 4y ago

Those who are a bit tech minded – consider adding DNS filtering on your home network (using pi-hole or something else). It has drastically changed my web experience for the better, including across iPhone apps, smart TVs and other surfaces where ad blockers can't help.

rrrrrrrrrrrryan 4y ago
I see this advice a lot but I can't imagine it working better than using a system level adblocker like AdAway on my phone. (Smart TVs I understand, though mine seem to be unusually ad-less compared to what I've heard Samsung does). What if you're out and about disconnected from WiFi? What if you need to turn the thing off for a sec to click on a sale/promotion in an email?
- paxys 4y ago
  What system level adblocker works on iOS?
  - rrrrrrrrrrrryan 4y ago
    Not sure - I haven't owned an Apple device since an iPod circa 2007. Do iPhones still really not have a way to block in-app ads?
    - sbuk 4y ago
      https://1blocker.com/ https://1blocker.com/ Is a system wide ad blocker. It’s not uBlock Origin in terms of coverage, but extremely close and it work on all apps.
- akoumis 4y ago
  Out and about: yeah install something on your phone (or use a self hosted vpn that plugs into pihole? never tried it) Need to click on sale: You can easily temporarily disable it in the web interface in 1 click It's a nice way to block ads for any wifi connected device in your house without additional setup. There are probably 10+ ad-serving devices in my house between the TV's, laptops, tablets, and phones.

panny 4y ago

I am puzzled here. Why is the FBI expecting the free market to solve the problem created by the free market? Are these scams somehow legal? If the scam is illegal, and search engines are promoting the scams at the top of search rankings, doesn't that make the search engine an accomplice in the scam? If I invited crack dealers to deal out of my house for a small cut of the proceeds, I'm pretty sure I go to jail when they're caught. That's essentially what search engines are doing here.

deleted 4y ago
[deleted]

dredmorbius 4y ago

Discussed on HN at the time (2 months ago), via TechCrunch: <https://news.ycombinator.com/item?id=34095107 https://news.ycombinator.com/item?id=34095107> (36 comments).

PeterisP 4y ago

The same applies to corporate networks - there is no good reason why the default office computer installations for your employees should have a browser without an ad blocker, there are some (not huge, but some) security benefits that make it a reasonable IT policy almost everywhere.

hsbauauvhabzb 4y ago
Protip: sell it to exec as a productivity bonus, the reduced cognitive load and accidental missclick a would add up in any medium of large business.
incompatible 4y ago
In the case of the FBI, et. al., who according to the article "are already reportedly using network-based ad-blocking technologies", I'd wonder if not being able to access certain material would hinder the investigation of scams.

71a54xd 4y ago

Sure, but ad-blockers are also basically adware that scans through the entirety of all websites you visit. Very similar snooping to custom keyboards etc...

yjftsjthsd-h 4y ago
> but ad-blockers are also basically adware that scans through the entirety of all websites you visit. Very similar snooping to custom keyboards etc... Er, not as a group they aren't. Like, I'm sure there are bad adblockers, but if you stick with uBlock Origin you'll be fine.
- 71a54xd 4y ago
  Why wouldn't uBlock Origin be targeted? Nobody is capable of auditing the entire codebase, paying off open source contributors flat out isn't hard and it's cheap.

userbinator 4y ago

I wonder when/if they'll also recommend JS whitelisting. The majority of browser exploits rquire JS to function, and even the occasional few which don't are likely going to be obfuscated using JS to avoid easy detection.

emacdona 4y ago

I recommend using an ad-blocker while visiting that site :-/ Lately, I find myself using more and more plugins to make the "modern web" tolerable. To list a few: Channel Blocker (lets me block channels from search results on Youtube); uBlock Origin; Disconnect; F.B Purity; Consent-O-Matic (auto fill cookie consent forms); Kagi Search; PopUpOFF; Facebook Container; Privacy Badger; ClearURLs; Return YouTube Dislike Basically, if I visit a website and don't like the experience, I either never go back (Kagi lets me exclude it from search results) or find a plugin to make it tolerable. What I really want now is the ability to exclude entire websites from any permissions I grant to plugins. I feel like in the last year, I've read a couple stories about companies buying successful plugins and then using them to track you or show ads or whatever. I'm worried this will be the next stage in the battle for our attention -- best case: companies will buy popular plugins to track us and show us intrusive ads; worst case: nefarious actors will buy them to scrape information we think is private and collect it. IE: I just want to be able to say "Hey, Firefox... those permissions that I granted to plugins x, y, and z? They don't apply to www.myfavoritebank.example.com" Is there a browser that has that feature yet? I spent a few hours trying to figure out if Firefox did. It did not appear to. edit: Added semicolons to separate plugins in list b/c HN stripped the newlines from my comment.

Groxx 4y ago
Yeah, the permission model in browser plugins is all kinds of messed up. In absolutely no way is it the plugin's decision where it should be allowed to run. It's great if it self-restricts and we should encourage that, but it's absurd in the extreme that any version of plugin support ever shipped without a way for users to override and restrict them further. Trusting the author of a thing to do what they claim to do is literal security insanity, and it always has been. Chrome is sightly improving here, with click-to-activate extensions, but it's still pretty far from just giving me a frickin list field.
kfoley 4y ago
> Is there a browser that has that feature yet? I spent a few hours trying to figure out if Firefox did. It did not appear to. I believe this will be supported by manifest v3 extensions in Firefox[1] which is one of the features I'm looking forward to for the same reason. [1]: https://blog.mozilla.org/addons/2022/10/31/begin-your-mv3-migration-by-implementing-new-features-today/ https://blog.mozilla.org/addons/2022/10/31/begin-your-mv3-mi...

gerdesj 4y ago

I rarely see ads. pfblocker-ng at the router. Privacy Badger lumbers alongside uBlacklist on the browser.

wankle 4y ago

uBlock Origin seems popular so I checked what permissions the Chrome Web Store says it needs: "Read and change all your data on all websites" "Change your privacy-related settings" It feels like this could give the US Government one stop shopping to ... me. Oh boy, I get my Christmas Goose early this year!

genmud 4y ago
Do tell me how you can block/remove ads from pages without having read and change?

ravenstine 4y ago

Why should we take advice from the FBI?

deleted 4y ago
[deleted]
Nemo_bis 4y ago
I don't, but Google is presumably not pleased to hear the FBI say "Cyber criminals purchase advertisements that appear within internet search results". https://www.ic3.gov/Media/Y2022/PSA221221 https://www.ic3.gov/Media/Y2022/PSA221221 The FTC, other regulators or courts in the countless cases against Google may also use such a statement as validation that fraud is rampant.

dngray 4y ago

> Disconnect, Privacy Badger, ClearURLs https://github.com/arkenfox/user.js/wiki/4.1-Extensions#-dont-bother https://github.com/arkenfox/user.js/wiki/4.1-Extensions#-don... Really these days about the only privacy extension you might need is uBO and possibly CanvasBlocker if you haven't set RFP. https://support.mozilla.org/en-US/kb/firefox-protection-against-fingerprinting https://support.mozilla.org/en-US/kb/firefox-protection-agai...

dngray 4y ago

One of the most important things you can do is enable ETP, (Enhanced Tracking Protection), set that to "Strict" and enable sanitizing on close: We have instructions for that https://www.privacyguides.org/desktop-browsers/#firefox https://www.privacyguides.org/desktop-browsers/#firefox

exodust 4y ago
I'd recommend expanding the browser configuration information on your site to include the options found under about:config. There's a bunch of settings in there not available under the main settings. Eg privacy.resistFingerprinting -- which actually has a bug where your browser suddenly stops opening full screen, even with this setting disabled. Solution is to toggle this setting on and off, restarting browser between toggles, and Firefox will remember to open full screen again next time if that's how you left it.

untangle 4y ago

This is interesting but it's old news. Both the linked article and the "FBI PSA" are dated late December of 2022.

errantmind 4y ago

There are a lot of great addons that improve browsing immensely. I'll dump mine: * ublock origin: block ads * uBlacklist: block domains from Google search results * SponsorBlock: skip sponsored segments in youtube videos * Thumbnail Rating Bar for YouTube™: show a rating bar along the bottom of each YouTube search result * Firefox Multi-Account containers: Site storage segmentation * Bypass Paywalls Clean: bypass site paywalls (mostly news) * Clear URLs: clean tracking / referrals from URLs * TTV LOL: block some Twitch ads * ViolentMonkey: Greasemonkey scripts for further site customization

timbit42 4y ago
Bypass Paywalls Clean is no longer on the Firefox add-ons website. You have to get updates here: https://gitlab.com/magnolia1234/bypass-paywalls-firefox-clean/-/releases https://gitlab.com/magnolia1234/bypass-paywalls-firefox-clea...

deleted 4y ago

[deleted]

vinay_ys 4y ago

It is simultaneously impressive and sad and hilarious that security of millions of people depend on the work of one volunteer software developer (gorhill – ublock origin) and a bunch of volunteer block-list maintainers.

geraldhh 4y ago
true then again, mainstream computing as a hole is largely built upon volunteer work as linux and open source are the basis of mobile _and_ cloud.

CyberSimon 4y ago

Anyone find it amusing that a UK site has to report on United States FBI recommendations...?

worldsavior 4y ago

Removing ads only makes you more unique. As most users don't block ads, by using an ad blocker sites can identify you more by knowing you use an ad blocker. It is more comfortable, but it's preferred using a wide DNS ad blocker as sites can only know that for some reason the DNS server can't resolve their domains. DNS ad blocker can also increase uniqueness. Using an ad blocker extension can also cause security issues, as the extension has full control on network traffic and has potential to be exploited.

nix23 4y ago
>Using an ad blocker extension can also cause security issues, But loading ad's are the much greater security issue. And if you care about "uniqueness" you have that already with your IP, so you should start there with yourOwnVPN, TOR etc.
- worldsavior 4y ago
  > But loading ad's are the much greater security issue. How so? You're just retrieving the data and displaying it. > And if you care about "uniqueness" you have that already with your IP There are many ISP's that use NAT to save IP addresses, hence an IP is not really an identifier. Even if not, an IP is identifieing the all network, and all the ones that are connected to the same network. You can see how in YouTube (incognito mode) you will always get personalized videos based on your IP approximate geolocation (usually just the state) if it's your first time.
  - nix23 4y ago
    >How so? You're just retrieving the data and displaying it. Yeah displaying data...that cant be dangerous ;) >There are many ISP's that use NAT to save IP addresses, hence an IP is not really an identifier. Do you really think your argumentation is good?
    - worldsavior 4y ago
      > Yeah displaying data...that cant be dangerous ;) It's not dangerous because it's coming from a good source, such as google ads. > Do you really think your argumentation is good? Yes, because that's what happens. I don't really think an IP is a good identifier because it's shared by others. Using cookies is a much better option.

sergiogjr 4y ago

Using Brave Browser and never looked back. I use MSEdge for work stuff (client testing as it's their default). It was vanilla, but recently I had to install uBlock (minimum). It was too unbearable to do a simple search for some technical info and end up on a website that would LITERALLY slow the OS as a whole due to spike on Edge's CPU and memory usage.

singeezie 4y ago

Misleading consents

dustedcodes 4y ago

That’s quite significant if the situation got so bad that even the FBI recommends a practice now which will arguably harm the profits of some of America’s largest corporations.

exodust 4y ago

The FBI page in question[0] (I hope ic3.gov is legit!) says "Before clicking on an advertisement, check the URL to make sure the site is authentic." But on a mobile device nobody knows how to do that. And the URL will be some kind of ad redirect a mile long. FBI: "Rather than search...type the business’s URL into an internet browser’s address bar..." I'm not sure about this one. Typos easily happen, and it's the typo'd domain that scammers might own. Risky whatever way you go I suppose. For well known businesses I'd rather search and click on organic links than trust my own typing of a URL. "Use an ad blocking extension". Third time's the charm. Great to see this advice coming from the FBI. https://www.ic3.gov/Media/Y2022/PSA221221 https://www.ic3.gov/Media/Y2022/PSA221221

silon42 4y ago
Yeah, it's been a long time outstanding to ban redirects to other domains.

walrus01 4y ago

I can't believe people use mobile browsers now that are not Firefox. Firefox on Android can have the full powered ublock origin addon installed in it. Same as desktop. It makes things so much better.

Kailhus 4y ago

This does make me wonder, is there any extension that can modify the DOM? I.e remove nodes aka a div container by className or change css and make it persist?

jiveturkey 4y ago

why only when searching?

puffoflogic 4y ago

The next major move in the adblocking wars will be to get them declared illegal. You heard it here first.

junaid1460 4y ago

Must’ve cracked deal with the blocker plugins