3 ms·
The hashes are checked against an endpoint hosted by Cloudflare. So technically Cloudflare or anyone able to MitM traffic to them (which would be anyone in a po
by mike_d 3y ago
The hashes are checked against an endpoint hosted by Cloudflare. So technically Cloudflare or anyone able to MitM traffic to them (which would be anyone in a position to MitM Facebook as well) can still do evil things.
I haven't ripped apart the extension yet, but there is no mention of cryptographically verifying the response from Cloudflare.
Edit: looks like they are checking for a number of ad blocking extensions and mark it as "At Risk" if detected.
Edit 2: Oh boy, I hope this is covered by their bug bounty program.
- userbinator 3y agolooks like they are checking for a number of ad blocking extensions and mark it as "At Risk" if detected Not surprised at all. As with a lot of things these days, the "security" they are talking about is to secure their ability to shove whatever shit they want down your throat without you being able to resist.