It leaves their privacy “completely compromised” when browsing online, said Palant, and can even exploit websites that have countermeasures such as a content security policy. The security flaw could enable malicious actors to spy on all websites that the user is visiting, leaving sensitive information such as banking details and other data potentially accessible. Palant included more technical details about the attack in a blog post. While it has been patched in Chrome and, since the time of writing, in Mozilla Firefox, no update has been issued for other browsers such as Microsoft Edge. It could be leveraged to achieve uXSS on victims’ devices, revealed researcher Wladimir Palant, meaning that arbitrary code could be executed on any domain.
The vulnerability was discovered in DuckDuckGo Privacy Essentials, which blocks hidden trackers and offers private browsing features. UPDATED DuckDuckGo has fixed a universal cross-site scripting (uXSS) flaw in a popular browser extension for Chrome and Firefox. Here's hoping he's successful in that effort.XSS security flaw has already been patched in Google Chrome and Mozilla Firefox "We disagree, and have made it our mission to set a new standard of trust online." "Because of widespread poor privacy practices, too many people believe you simply can’t expect privacy on the Internet," he observed. Taking it a step further, Weinberg believes the DuckDuckGo Privacy Browser could help point the way toward a future where privacy is the default - not the exception. " product is for everyone who doesn’t like the feeling of being watched, doesn’t like ads following them around everywhere they go, or doesn’t like the idea of companies making money off their personal information," he explained in a statement provided to Mashable. So who, exactly, is this for? Well, according to Weinberg, that would be pretty much everyone. "Too many people believe you simply can't expect privacy on the Internet"
The app also blocked some display ads, which was an added bonus. The experience felt much like browsing the web on iOS's Safari, but with the additional benefit of being able to see what ad trackers were shut down on each website we visited. We downloaded the DuckDuckGo Privacy Browser, as the app is officially called, on an iPhone and gave it a spin. In addition to blocking ad trackers, the app forces HTTPS on sites that have it but for whatever reason didn't serve you the encrypted page. The only app that matters this year is Signal
0 kommentar(er)
