Thread · 2 tweets · 2 Apr 2021

Solid research piece on using programmatic to deliver malicious payloads to national security targets. Homing in on specific targets whose email address you have is also a fun and cheap option in a world of hashed email targeting!

Security decisions like SafeFrame shouldn't be publisher decisions, because publishers can be pressured away from them if they need the money. We should have an <ad> element with strict security and get rid of iframes and code injection.