German freemail sites trick Firefox and Chrome users into removing AdBlock

http://gebloggendings.wordpress.com/2014/02/27/german-freemail-sites-trick-firefox-chrome-users-into-removing-adblock/

by ttaubert • 12 years ago

191 140 12 years ago

gebloggendings.wordpress.com

Cenk• 12 years ago

Disgraceful.

One of the providers, web.de, also sends it’s users emails with advertisements which cannot be disabled or marked as spam.

antr• 12 years ago

https://en.wikipedia.org/wiki/There_ain't_no_such_thing_as_a...

Intermernet2• 12 years ago

Except for Wikipedia...

mistercow6• 12 years ago

That's not really what TANSTAAFL means. It's about opportunity cost and externalities, not bait and switch tactics.

ckoepp• 12 years ago

Well, 1&1/United Internet has a reputation for such bad behavior [1,2].

Actually it's quite easy to just enter some address and order some useless premium services "in behalf" of other people - this actually happened to a member of my family. According to consumer protection organizations this seems to be their business model [3,4].

Note that those links are in German: [1] http://de.wikipedia.org/wiki/Web.de#Kritik [2] http://de.wikipedia.org/wiki/Gmx.de#Kritik [3] http://www.augsburger-allgemeine.de/digital/Glueckwunsch-Abz... [4] http://www.verbraucherzentrale-niedersachsen.de/link1811119A...

rjzzleep• 12 years ago

oh web.de easily the most dangerous free mail sites there is.

it belongs to 1&1[1] one of the bigger internet companies in germany.

it's really odd that no one ever shot them down. they are famous for tricking users into shady 2 year contracts, if they wanted to upgrade their 12 mb mailbox.

they also upgraded the freemail to 500mb if and only if you would install their browser toolbar, which would change the mail server etc. now it's 1gb with toolbar i think.

they tried to force my mum into a contract, because she clicked on a banner while logging(for free xxx mb click here style banners). then promptly closed the account should she not pay.

the result was her saying fuck it i'll use gmail.

http://en.wikipedia.org/wiki/1%261_Internet

http://www.teltarif.de/web-de-freemail-speichererweiterung/n...

mironathetin3• 12 years ago

Confirmed. I use web.de since 1998 as a spam-box, to keep my real account clean. During the last years they indeed try all tricks (we have a present for you, 3 weeks of free membership blah, blah..). If you leave this page now, the present will expire. There is a way to simply ignore this sh..t. All of it.

But I agree that it takes discipline (germans are good at that :o). Gmail, on the other hand, cannot be trusted either. While web.de is evil, google is evil too, but google is bigger and google is not an european company. All of the data is used abroad thus circumventing civilized laws.

The real problem is this: these companies offer a service and everybody expects free services online. Of course the companies have to make money. Ask yourself: would you pay for an email account (I do)? If not, you have to accept ads. Or googles snooping in your data and selling your profile to everyone who pays. There is no free beer online. At least web.de shows us how ugly it gets, if things have to look like they were free.

This is not intended to excuse the primitive tricks we.de uses. But if you have a solution, post it here and I'll get rich.

microtonal4• 12 years ago

Or googles snooping in your data and selling your profile to everyone who pays.

You should really read Google's privacy policy:

http://www.google.com/policies/privacy/

So, no, they don't sell your profile.

I do agree with your point: if you don't want advertisements. Pay for the service. E.g. Google Apps for domains allows you to disable adds in Google apps. And since you can bring your own domain, you can move to some other service if you are not happy with them.

_quasimodo• 12 years ago

Can you recommend a paid european mail service?

Trufa• 12 years ago

I live in Austria now and it is amazing the amount of people who use GMX.

I've been on a crusade to try to make people switch to, well, whatever but not that.

I think it was one of the first ones around here and people got used to it and the status quo, most don't even know or care about how bad they've got it.

smoe• 12 years ago

Can confirm. GMX was the first email provider I used, since it was cool because it was not hotmail and still had a lot of names available. I still use my 3 letter gmx account as a spambox nowadays.

frik2• 12 years ago

True, GMX is popular in Austria. Especially the kids and youth now use GMX instead of GMail or Outlook.com. For some reasons they trust European companies. (privacy, dislike NSA spying, etc.)

Though, GMX has done some shady business over the years and their servers are in Germany. They would be better off with some other email provider...

blueskin_4• 12 years ago

mail.com recently had their outbound servers listed on Spamhaus for the best part of a week.

I noticed as a mail.com user was trying to email me and the message was being rejected, saw the spamhaus listing in my logs. Asked the sender, and they said that their messages to gmail were going into spam too.

I emailed postmaster@, support@, sysadmin@ etc. to try and inform them, as well as trying two contact forms; never heard anything back and it took several more days for the listing to disappear.

blueskin_4• 12 years ago

I doubt even many users will be stupid enough to not only click some random fake error ad, but follow the advice of a dodgy site. Almost everyone who has adblock installed it knowingly, wanting the effect and knowing what it does.

Perseids• 12 years ago

What about all those friends and relatives we do tech support for. Most of them have not installed their addons on their own.

blueskin_4• 12 years ago

Some but not all. I've been mildly surprised to see family members running chrome (yes, I know, privacy issues with chrome, but better than IE...) or firefox with an ad blocker before.

eik3_de• 12 years ago

This is so embarrassing and disgusting. For reference, here's a list of United Internet properties to avoid:

        1&1 (aka 1and1.com)
	GMX
	WEB.DE
	InterNetX
	united-domains
	Sedo
	mail.com
	Fasthosts
	affilinet
	Arsys

donrhummy• 12 years ago

+1. Stay far away from 1and1.com! I had the worst experiences with them of any tech company. Customer service doesn't get worse than them.

vostrocity• 12 years ago

I would stay away from 1and1 in the future, but their customer service seems alright. The main thing to watch out for is they don't notify you when a contract is about to expire and instead send you the bill after it auto-renews. My fault for getting used to other registrar/hosting services' conventions. They waived and cancelled my account after I called though. I'd say they're a bit more upstanding than EIG's[1] brands.

[1] http://www.digitalfaq.com/editorials/websites-blogs/hostgato...

iancarroll• 12 years ago

Has anyone had bad experiences with sedo? I haven't.

chrischen• 12 years ago

I have. They accused me of offering a bid to myself (I didn't) and made no recourse to defend myself.

scurvy• 12 years ago

Anyone who does business with 1&1 deserves what they get. They're known to generally be amongst the worst in the industry.

Orangeair• 12 years ago

That's a little unfair. With web hosting platforms like this offering increasingly low barriers to entry, they are accordingly attracting people who know less about technology, and are more likely to be persuaded by prices than informed industry opinion. For instance, I bought a domain from 1&1 when I was in middle school, just for a stupid personal website. I went with them because they were the cheapest and didn't know any better. I don't feel as if I would be to blame in that situation.

sauerbraten• 12 years ago

Just to clear one thing up: the fake warning message doesn't say the security is "compromised", but rather "limited" or "constrained": http://pda.leo.org/ende/index_de.html#/search=eingeschr%C3%A...

What they pull is still shady, but the text seemed a bit sensationalist at that point.

userbinator3• 12 years ago

What I don't get is why something like AdBlock should even be detectable...

Incidentally, I remember reading before that Germany had the largest percentage of users using AdBlock, so it makes sense that the pushback is starting here.

DanBC2• 12 years ago

I don't understand it.

Someone has said that they do not view advertising. They have modified their browser to avoid ads.

A marketer choses to ignore that person's choice and choses to use tricky technical means to ignore that person's wishes in order to show an ad.

How is that in any way beneficial to the product being advertised?

I am ad tolerant (don't run ad blockers etc) but behaviour like that fills me with rage. It is exactly the same kind of attitude that said it is fine to spew email to anyone whether they want it or not.

Marketers need a code of conduct to say that this behaviour is unacceptable.

chii2• 12 years ago

How is that in any way beneficial to the product being advertised?

it isn't. But the clients of the advertisers cannot really have a say in this - the measurements of ad effectiveness tend to be done with impressions. They are optimizing for a metric that doesn't completely align with the goals of advertising

mason2403• 12 years ago

You should modify your browsing habits to only include sites without ads then.

GhotiFish2• 12 years ago

I'm highly intolerant of ads. I have limited focus. Most of all, ads scare me. I'm afraid they may have a potentially compounding effect on the way I think.

but the default position of most people is to disregard someone's position. There is a stunningly vast portion of the population that actively assumes that everyone believes the same as they do, even if they know otherwise.

"I can't focus with the tv on" "Yes you can." turns tv louder

marketers ignoring stated positions for money is a symptom of the greater disease of people ignoring others positions.

shimfish• 12 years ago

I drove myself insane for a morning recently when I couldn't work out why a site of mine that had happily been working for years suddenly stopped displaying some images in the carousel. They were there in the HTML but Chrome reckoned they were zero size. Eventually, it hit me that I should try turning off adblock. Turns out, I had called the imgs containg divs "#ad1", "#ad2". "#ad3", etc were all fine for some reason.

Anyway, the point is that you could probably easily check for adblock by checking the image size of something within a div named "advert".

slipstream-2• 12 years ago

I once had to use a method like this to detect adblock to specificially deny a somewhat intrusive ad from being displayed, as adblock screwed it up enough that it wouldn't close.

psykovsky• 12 years ago

And you described the main reason why people who say ad blockers "protect users" are wrong. They just hide the ads, they don't block them. Better to just send to localhost all known ad network domains. There are some noce precompiled lists around the web for that exact purpose.

mediumdeviation• 12 years ago

Why wouldn't it be detectable? Ad blockers do their job by removing elements from the page, blocking requests to URLs that match those used to serve advertisements, or a combination both, and either one of those are easily detectable by client-side JavaScript.

userbinator3• 12 years ago

Then perhaps a different method should be used - although removing all the stuff that makes up adverts is one way to do it (and often does make for faster page loads and lower bandwidth consumption), if the end goal is the user just doesn't want to see them, maybe that's what we should do: everything except render certain elements.

(There's also the alternative of targeting the scripts that do this; an anti-anti-adblock! Reminds me of the arms race between malware attempting to prevent itself from reverse-engineering via detecting debuggers and such, and the opponents coming up with anti-anti-debugging, leading to anti-anti-anti, and so forth...)

fizz_and_buzz• 12 years ago

They add a little javascript function that they call advertisment.js or something similar which just adds a div to the page (e.g.: document.write('<div id="test"></div>'); ). They then check if the div exists when the document is ready and notify the server. Adblock has a filter feature where you can enable specific javascript functions on a site, which allows you to circumvent this trick.

slipstream-2• 12 years ago

Socialing people to remove adblock?!

I'm amazed they don't just social people to download toolbar claiming to fix the "security compromises".

r00fus• 12 years ago

Because a) one is already known as being scammy and b) doing the latter might get the site listed as a ad/malware provider, which may run into browser and protection suites labeling the site.

bencollier49• 12 years ago

Doesn't claiming that Adblock is "malicious" come under the remit of libel laws?

chalst• 12 years ago

I haven't found that exact claim on the site. It does list these blockers as "Liste von bekannten seitenmanipulierenden Add-ons" (known site-manipulating add-ons) [2] and on the main page "Diese seitenmanipulierenden Add-ons stellen ein erhebliches Sicherheitsrisiko für Sie dar!" (these site-manipulating add-ons put you in a situation of increased security risk) [1]. Together, these two assertions might be libellous, but because they are not together, I guess it is not as straightforward as the words of Michael Büker's post suggests.

[1] http://www.browsersicherheit.info

[2] http://www.browsersicherheit.info/addons.html

jruderman• 12 years ago

Ad-blockers protect against attacks coming from compromised ad servers, but also increase your total attack surface. The message is misleading about the relative risks, and it's dishonest in singling out ad-blockers among thousands of extensions, but I wouldn't say it's blatantly false.

Is it libelous against browser makers, though? They spoof the browser's info bar and I believe they style the landing page to look like an internal browser page.

patal• 12 years ago

Can we update the AdBlock list to suppress said yellow bar from display?

rmoriz• 12 years ago

in the works: https://hg.adblockplus.org/antiadblockfilters/rev/fa117e18b7...

marcosdumay2• 12 years ago

It would be better to update browsers, to display a different warning, in a place where a page can't change at all. (And while we are there, Firefox, please, do the same with the master password dialog.)

But I doubt any of them will do that because, security be damed, it messes with the minimalist fashion.

mistercow6• 12 years ago

It would still be helpful even if they just modified the warnings to bleed into the non-page portion of the window somehow. It doesn't have to compromise minimalism. They just need to be creative about it.

But I think the best place for it would be between the tab bar and the location bar.

inanov2• 12 years ago

The requested URL / was not found on this server.

webpages at http://browsersicherheit.info/ seems to be removed.

http://web.archive.org/web/20140226224721/http://www.browser... says that adblock "Filters page content"

inanov2• 12 years ago

apparently they just removed the website index

http://www.browsersicherheit.info/addons.html

ehPReth• 12 years ago

You need the www. bit in the URL. http://www.browsersicherheit.info/ produces the homepage but http://browsersicherheit.info/ produces a 404

adrianmn8• 12 years ago

As someone that has been involved in online publishing for over 10 years I have a strong opinion about ad blockers.

In my opinion using ad blockers is borderline piracy. Refusing the content creator his revenue by blocking his ads is little different than downloading music, books... without rewarding the creator. On top of that most of the quality content this days is on websites that have decent ads.

I am not trying to start a dispute if piracy is good or bad just wanted to express an opinion on ad blockers that many seem to miss.

mschuster912• 12 years ago

The problem is that without adblockers the web is basically useless due to too many publishers becoming too greedy and torturing their users with sometimes dozens of layer,banner,popup,popunder and scareware ads on one(!) page.

adrianmn8• 12 years ago

Do you see how that is in perfect connection with the reason people pirate stuff?

Anti-piracy main reasoning is that if it's too expensive(too many ads in your case) just don't buy it. The 2nd main reason is lack of availability(in ad blocker case - lack of sites with less ads that give you same content).

recursive• 12 years ago

I don't use ad blockers, and I disagree with your claim that the web is useless.

mason2403• 12 years ago

I don't use adblockers and have never had any problems.

adrianb• 12 years ago

Also people shouldn't be allowed to change the channel on tv when the ad breaks begin or even leave to use the toilet! They should be forced to sit and watch everything or else the ratings of the ads will not match the ones for the show.

My point it: people mostly hated ads since they were invented. Be it by not looking at them on the street, changing channels on tv or installing AdBlock on your computer, they do their best to avoid them.

adrianmn8• 12 years ago

The TV ad example is a false analogy. If the page has ads that you don't want to see you can close it(no one forces you to watch it) or go for the toilet break.

I agree that people hate ads and people also hate paying for things that can get for free(piracy).

You guys are missing my point of ad blockers being borderline piracy and mainly try to justify your reason for using them.

r0h1n• 12 years ago

What if users don't block ads but never click on one either?

adrianmn8• 12 years ago

That is a publisher and advertiser problem as they did not create an ad relevant and/or engaging enough.

With retargeting ads this days it becomes easier to show relevant and targeted ads.

Actually most HN-ers are leaving huge money on the table right now for not using the highest ROI ad channel - retargeting.

DanAndersen4• 12 years ago

I agree there are some parallels between ad-blocking and piracy (though they do tend to be in the realm of the "piracy = theft" idea rather than copyright-related parallels).

However, I think it's also important to recognize that by similarly-strong analogy, advertisements in general are inherently a sort of mental manipulation or brainwashing.

Now, I'm not saying that mental manipulation is inherently a bad or evil thing. When I'm writing this post, I hope that those reading it will become in some way more mentally accepting of my point of view. But I think we don't look enough at how susceptible we are to advertising, and how much advertising depends on exploiting cognitive biases or implying untruths that are not explicitly stated.

We (humans) are really bad at not being affected by advertising, even if we know we're being advertised to, and even if we know the ad is deceptive. When sites depend on ad revenue, they're saying "We're offering this content for free, but in exchange we want to be able to bias/prime your brain so that when you see Product X, even far in the future, you are more likely to desire it." That's a very powerful thing, and while it's certainly necessary for many business models today, I think we should think of this as a "necessary evil."

There are sites where I disable ad-blocking, often in response to a genuine plea on the part of the website. If it's a site I particularly care about and feel that I trust, then I allow ads as a way of helping them out. But if ad-blocking is piracy, then ads themselves are brainwashing -- exploiting failings in human cognition to unconsciously guide people into actions or purchases that may or may not be optimal for them -- and with the subject having limited defenses against it once infected.

adrianmn8• 12 years ago

Completely agree with you on the points about the risk of brainwashing and impulse buying and people not realising how powerful and dangerous ads can be.

I would not go that far and claim all ads are brainwashing and manipulative. Going this route it means all communication is manipulative as there is an intention behind every word.

skue• 12 years ago

In my opinion using ad blockers is borderline piracy.

Once upon a time I agreed with you... now I view all online ads as threats.

Unfortunately, marketing companies have gotten greedy and the degree to which they fingerprint and track us as we surf the web has gotten completely out of hand. This is an industry that cannot even follow their own watered-down initiatives like DoNotTrack.

And because ad networks use layers of affiliates, sites typically have no visibility nor control over what their visitors are being served. That's why you end up with a marketing company like Evidon buying Ghostery - just so they can help companies monitor the garbage on their own pages![3]

And to top it off, ads are now a common attack vector for viruses and malware that not even the big companies can control:

1. Just last week, Youtube was serving banking malware via its online ads. [1]

2. Last month Yahoo got a lot of attention serving Bitcoin malware via online ads on their site. [2]

I know that online publishing is important, and we need a strong press. But publishing desperately needs to find a new business model because online ads are a failed experiment and it's time to stick a fork in them.

[1] http://labs.bromium.com/2014/02/21/the-wild-wild-web-youtube...

[2] http://www.cnn.com/2014/01/05/tech/yahoo-malware-attack/inde...

[3] https://www.ghostery.com/faq#q15

rcfox• 12 years ago

Personally, I find that people who directly depend on ad revenue contribute very little to my life. In the software industry, content creators who are paid to participate in the field tend to produce much better content than those who are paid to produce content.

marcosdumay2• 12 years ago

I'm more than happy to see your ads. I'll even click on it, and buy things from the target if I like what I see. I've done that several times in the past. In fact, when they are relevant, and in moderated amounts, I do like ads.

Now, I'm sure that you took care to guarantee that your ads won't track me, or try to invade my computer, right? Because if you didn't, it's blocked and you can whine and call me bad names the entire day, it won't change a thing.

By the way, I never saw adblockers blocking properly applied, safe to load ads. Maybe they do, I don't use them for quite a long time (I use other tech).

fauigerzigerk• 12 years ago

I also want the ad funding model to be viable. I'm happy to consider ads on my screen as a form of payment and I would not block them out of convenience alone.

But if the advertising industry starts to act like one huge criminal enterprise without any limits to the kind of deceptive practices they use I'm forced to defend myself.

I see no reason to be fair to those who deceive me whenever they can.

mindslight2• 12 years ago

As someone who has used an ad blocker for over 10 years, I have a strong opinion about the ad industry.

Die out, go away, and let us get back to the point where the motivation to publish something on the 'net stems from the desire to share knowledge. To hell with the cacophonous status quo of doing the bare minimum to trick people into giving you their attention in order to fill their head with garbage for a fraction of a penny. And if hosting honest content using central servers costs too much to be sustainable, then let that dead-end approach leave us and make room for decentralized software to deliver information.

netrus• 12 years ago

I dont get your comment. Not content delivery is expensive, but content creation Do you want a net without professional journalism?! Or do you prefer paywalls? Or donations?

I am in favor of a great coordinated blackout campaign by the large content providers. Dont want to see ads? Fine, pay a dollar via Paypal to see the site - or go away.

mendelk2• 12 years ago

ABP for Chrome has the "Allow some non-intrusive advertising" flag for precisely this reason: to reward creators who use ads deemed "acceptable".

This flag is checked by default.

More Info: https://adblockplus.org/en/acceptable-ads

_pghu• 12 years ago

The problem is that "acceptable" in this context means "paid protection money to the ABP dev".

(see https://adblockplus.org/en/acceptable-ads-agreements)

__david__4• 12 years ago

You act like there's some sort of contract that says I have to download and display everything in your html.

There is not.

mistercow6• 12 years ago

As someone who has paid for advertising on websites, I'm happy that some of the users who are definitely not going to click on the ad aren't served them.

But beyond that, this is pretty irrelevant to the topic at hand. However you feel about ad blockers, tricking people into turning them off is still completely unacceptable.

sweedy• 12 years ago

some years ago i worked for 1 & 1, and when I think back to their customers, i can imagine that it would work. And I see the reason also because they were one of the first to have offered in Germany emails that were in vain financed by massive advertising, and AdBlock is certainly no fun for them. Just to compare, this looks my Landing Page with, and without AdBlock.. http://i.imgur.com/bgTCRJN.png

agapos• 12 years ago

Wouldn't be possible to sue them for misleading of customers (users) or something similar?

BrownBuffalo• 12 years ago

Those pesky Germans. Always up to something sneaky.

hiphopyo• 12 years ago

Are there any ways for websites to bypass AdBlock? Anybody know of any JS projects on GitHub or similar that do this?

__david__4• 12 years ago

What's the point? It's just an arms race you could never win...

teleclimber• 12 years ago

This shows very clearly why browser warnings (aka "permission infobars") that are embedded on the page are bad.

http://chromespot.com/wp-content/uploads/2014/02/screen_quot...

By getting the user accustomed to seeing browser warnings and info there, you make it impossible for them to distinguish a legit browser warning from a fake one crafted by an unscrupulous site owner.

Browser warnings and notifications should significantly overlap the browser chrome (embedded in the address bar for example) so that no web page can make something that looks like it.

edit: image link

nollidge• 12 years ago

Similarly, this is a major problem with Chrome showing settings in a browser page.

cal2• 12 years ago

Thanks for bringing these two things to my attention. It's incredible what I can overlook in tools I use everyday. I love it when I learn something new though!

frik2• 12 years ago

GMX plans to show a fake Firefox warning page, screenshot: http://www.browsersicherheit.info/img/anleitungen/ff_win/fir...

  The GMX website is disrupted by a plugin

  (orginal: Die GMX Website wird durch ein Plugin gestört)

As you can see on their "information campaign" page: http://www.browsersicherheit.info/sicherheit_ff.html

They also faked press articles: http://www.browsersicherheit.info/pressestimmen.html (two websites are related to "1&1"-company and they other one is "Bild")

mistercow6• 12 years ago

There's only one appropriate response to this from browser vendors: add those sites with to the malicious site list so that they show the big "danger ahead" warning when you visit them.

This kind of social engineering approach to removing an extension is not significantly different from a browser exploit that achieves the same result.

RamiK• 12 years ago

Really a shame for them to resort to such unscrupulous tactics. I quite like 1&1 too. Their mail.com mobile interface ( https://m.mail.com/int/ ) works with NoScript and is perfect as far as my needs are concerned. Quite nice looking too. Very flat and minimal while being completely functional.

Such a shame...

German freemail sites trick Firefox and Chrome users into removing AdBlock

Related Stories