6 ms·

one word: Flashblock

• there 15y ago
  flashblock is not good at blocking flash from a security standpoint. with it enabled, visit http://lcamtuf.coredump.cx/html5object/ http://lcamtuf.coredump.cx/html5object/ and you'll probably see at least one flash animation start. http://lcamtuf.blogspot.com/2011/03/warning-object-and-embed-are-inherently.html http://lcamtuf.blogspot.com/2011/03/warning-object-and-embed...
  • Natsu 15y ago
    Maybe flashblock isn't good enough, but when combined with noscript, it didn't let anything on that page slip through.
    • there 15y ago
      noscript natively supports blocking embedded things with a click-to-activate interface, so if you're using noscript there's no need for flashblock.
      • bobds 15y ago
        The thing I like about NoScript is that you can set it to block everything, even on trusted sites. You have to click the placeholder to make it load, or if there isn't a placeholder (web fonts, hidden flash embeds) you have to look at the Blocked menu.
    • deleted 15y ago
      [deleted]
  • kevingadd 15y ago
    Thanks for the link to that demonstration. Hadn't seen anything bypass flashblock before. Switched to NoScript and confirmed that it actually blocks all of the test cases.