as someone who claims they are a programmer and researcher... you would think they would have done some more research on this and also have common sense to know that this isn't a keylogger.
Banner ads on CNN.com contain keyloggers
61–70 of 83 posts
Re: Banner ads on CNN.com contain keyloggers
#62Lots of speculation here, not much analysis, even from lazy gits like me. Chrome web inspector kindly gives the "Initiator" for every request. In this case it's cnn-header-second.min.js. Load that, and Chrome again kindly detects minified JS and offers to pretty-print it. The context here appears to be some kind of ad console tool, added by CNN, not by an ad. The relevant function is at https://pastebin.com/EwgPAM6T…
Functionality is to enable an "AdFuel Creative Review" form when typing "d o h" anywhere on the page. Try it. Then click the blue icon in the lower right.
Re: Banner ads on CNN.com contain keyloggers
#63Earlier quoted context omitted.
Google's monopoly status means it fulfills 90+% of the ads. I can guarantee you that CNN has no control. There is no competition. So, erm, maybe the onus is on Google?
Surely a company as big as CNN can run their own ad service instead of contracting it out. Do they pass the buck like this for ads on their TV channel?
They probably do run it. Just they are looking for the highest paying ads that don't have a boob in them or a penis. If the highest paying ad is a keylogger, that's generally not what they're looking for when they're filtering it out.
Re: Banner ads on CNN.com contain keyloggers
#64cross domain script blocking should be enforceable in all browsers
Re: Banner ads on CNN.com contain keyloggers
#65This is a prime example of how people so easily accept a headline shared on some news authority to be truth. Even the bright minds at hacker news are duped - just look at all the discussion happening here with the assumption the headline is correct.
The guy who tweeted this jumped to a conclusion, naively shared his discovery, then let it perpetuate leaving numerous victims of an erroneously altered world-view.
Re: Banner ads on CNN.com contain keyloggers
#66I would suggest their "lite" [1] version. It is compatible with addons like NoScript, uMatrix, uBlock, Canvas Fingerprint Defender, CSS Exfil Protection, Privacy Settings and Self Destructing Cookies. I am using FF 52 ESR. Some of these addons may not work in 58+.
They could improve their HTTP header settings a bit. [2]
[1] - https://lite.cnn.io/
[2] - https://securityheaders.com/?q=https%3A%2F%2Fcnn.com%2F&foll...
Re: Banner ads on CNN.com contain keyloggers
#67Re: Banner ads on CNN.com contain keyloggers
#68Sites bemoan ad blockers but then take no responsibility for the ads that are shown. That needs to change - it’s not like print advertising.
Bad ads appear with every ad network, and ad networks are lazy to stop it because they know that sites will take all the blame (your comment is a great example). Pop into /r/adops sometime (or the associated slack channel) and watch site owners working nonstop to try to find a solution to this problem. It's mostly a game of whack-a-mole at this point with no real long-term solution in sight.
Re: Banner ads on CNN.com contain keyloggers
#69CNN, like the vast majority of news sites, is best viewed with javascript disabled. Pages load 10X faster, scrolling is not jumpy, the CPU doesn't go crazy, and text reads just as well. It is hands down a much improved user experience.
Re: Banner ads on CNN.com contain keyloggers
#70This is a prime example of how people so easily accept a headline shared on some news authority to be truth. Even the bright minds at hacker news are duped - just look at all the discussion happening here with the assumption the headline is correct. The guy who tweeted this jumped to a conclusion, naively shared his discovery, then let it perpetuate leaving numerous victims of an erroneously altered world-view.
I seriously think people shouldn't be able to comment / see comments on HN unless they've at least clicked on the darn link. I took one look at the "keylogger" source code and recognized it.